blob: e6f863b008894fae73addde0f030f1ea5e105bb6 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * The RSA public-key cryptosystem
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
Hanno Becker74716312017-10-02 10:00:37 +010021
Paul Bakker5121ce52009-01-03 21:22:43 +000022/*
Simon Butcherbdae02c2016-01-20 00:44:42 +000023 * The following sources were referenced in the design of this implementation
24 * of the RSA algorithm:
Paul Bakker5121ce52009-01-03 21:22:43 +000025 *
Simon Butcherbdae02c2016-01-20 00:44:42 +000026 * [1] A method for obtaining digital signatures and public-key cryptosystems
27 * R Rivest, A Shamir, and L Adleman
28 * http://people.csail.mit.edu/rivest/pubs.html#RSA78
29 *
30 * [2] Handbook of Applied Cryptography - 1997, Chapter 8
31 * Menezes, van Oorschot and Vanstone
32 *
Janos Follathe81102e2017-03-22 13:38:28 +000033 * [3] Malware Guard Extension: Using SGX to Conceal Cache Attacks
34 * Michael Schwarz, Samuel Weiser, Daniel Gruss, Clémentine Maurice and
35 * Stefan Mangard
36 * https://arxiv.org/abs/1702.08719v2
37 *
Paul Bakker5121ce52009-01-03 21:22:43 +000038 */
39
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020040#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000041#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020042#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020044#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020046#if defined(MBEDTLS_RSA_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000047
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000048#include "mbedtls/rsa.h"
Hanno Beckera565f542017-10-11 11:00:19 +010049#include "mbedtls/rsa_internal.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050051#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000052#include "mbedtls/error.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000053
Rich Evans00ab4702015-02-06 13:43:58 +000054#include <string.h>
55
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020056#if defined(MBEDTLS_PKCS1_V21)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000057#include "mbedtls/md.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000058#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000059
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
Paul Bakker5121ce52009-01-03 21:22:43 +000061#include <stdlib.h>
Rich Evans00ab4702015-02-06 13:43:58 +000062#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020064#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000065#include "mbedtls/platform.h"
Paul Bakker7dc4c442014-02-01 22:50:26 +010066#else
Rich Evans00ab4702015-02-06 13:43:58 +000067#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020068#define mbedtls_printf printf
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +020069#define mbedtls_calloc calloc
70#define mbedtls_free free
Paul Bakker7dc4c442014-02-01 22:50:26 +010071#endif
72
Hanno Beckera565f542017-10-11 11:00:19 +010073#if !defined(MBEDTLS_RSA_ALT)
74
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050075/* Parameter validation macros */
76#define RSA_VALIDATE_RET( cond ) \
77 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_RSA_BAD_INPUT_DATA )
78#define RSA_VALIDATE( cond ) \
79 MBEDTLS_INTERNAL_VALIDATE( cond )
80
Manuel Pégourié-Gonnard1ba8a3f2018-03-13 13:27:14 +010081#if defined(MBEDTLS_PKCS1_V15)
Hanno Becker171a8f12017-09-06 12:32:16 +010082/* constant-time buffer comparison */
83static inline int mbedtls_safer_memcmp( const void *a, const void *b, size_t n )
84{
85 size_t i;
86 const unsigned char *A = (const unsigned char *) a;
87 const unsigned char *B = (const unsigned char *) b;
88 unsigned char diff = 0;
89
90 for( i = 0; i < n; i++ )
91 diff |= A[i] ^ B[i];
92
93 return( diff );
94}
Manuel Pégourié-Gonnard1ba8a3f2018-03-13 13:27:14 +010095#endif /* MBEDTLS_PKCS1_V15 */
Hanno Becker171a8f12017-09-06 12:32:16 +010096
Hanno Becker617c1ae2017-08-23 14:11:24 +010097int mbedtls_rsa_import( mbedtls_rsa_context *ctx,
98 const mbedtls_mpi *N,
99 const mbedtls_mpi *P, const mbedtls_mpi *Q,
100 const mbedtls_mpi *D, const mbedtls_mpi *E )
101{
Janos Follath24eed8d2019-11-22 13:21:35 +0000102 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500103 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100104
105 if( ( N != NULL && ( ret = mbedtls_mpi_copy( &ctx->N, N ) ) != 0 ) ||
106 ( P != NULL && ( ret = mbedtls_mpi_copy( &ctx->P, P ) ) != 0 ) ||
107 ( Q != NULL && ( ret = mbedtls_mpi_copy( &ctx->Q, Q ) ) != 0 ) ||
108 ( D != NULL && ( ret = mbedtls_mpi_copy( &ctx->D, D ) ) != 0 ) ||
109 ( E != NULL && ( ret = mbedtls_mpi_copy( &ctx->E, E ) ) != 0 ) )
110 {
111 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
112 }
113
114 if( N != NULL )
115 ctx->len = mbedtls_mpi_size( &ctx->N );
116
117 return( 0 );
118}
119
120int mbedtls_rsa_import_raw( mbedtls_rsa_context *ctx,
Hanno Becker74716312017-10-02 10:00:37 +0100121 unsigned char const *N, size_t N_len,
122 unsigned char const *P, size_t P_len,
123 unsigned char const *Q, size_t Q_len,
124 unsigned char const *D, size_t D_len,
125 unsigned char const *E, size_t E_len )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100126{
Hanno Beckerd4d60572018-01-10 07:12:01 +0000127 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500128 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100129
130 if( N != NULL )
131 {
132 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->N, N, N_len ) );
133 ctx->len = mbedtls_mpi_size( &ctx->N );
134 }
135
136 if( P != NULL )
137 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->P, P, P_len ) );
138
139 if( Q != NULL )
140 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->Q, Q, Q_len ) );
141
142 if( D != NULL )
143 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->D, D, D_len ) );
144
145 if( E != NULL )
146 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->E, E, E_len ) );
147
148cleanup:
149
150 if( ret != 0 )
151 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
152
153 return( 0 );
154}
155
Hanno Becker705fc682017-10-10 17:57:02 +0100156/*
157 * Checks whether the context fields are set in such a way
158 * that the RSA primitives will be able to execute without error.
159 * It does *not* make guarantees for consistency of the parameters.
160 */
Hanno Beckerebd2c022017-10-12 10:54:53 +0100161static int rsa_check_context( mbedtls_rsa_context const *ctx, int is_priv,
162 int blinding_needed )
Hanno Becker705fc682017-10-10 17:57:02 +0100163{
Hanno Beckerebd2c022017-10-12 10:54:53 +0100164#if !defined(MBEDTLS_RSA_NO_CRT)
165 /* blinding_needed is only used for NO_CRT to decide whether
166 * P,Q need to be present or not. */
167 ((void) blinding_needed);
168#endif
169
Hanno Becker3a760a12018-01-05 08:14:49 +0000170 if( ctx->len != mbedtls_mpi_size( &ctx->N ) ||
171 ctx->len > MBEDTLS_MPI_MAX_SIZE )
172 {
Hanno Becker705fc682017-10-10 17:57:02 +0100173 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Hanno Becker3a760a12018-01-05 08:14:49 +0000174 }
Hanno Becker705fc682017-10-10 17:57:02 +0100175
176 /*
177 * 1. Modular exponentiation needs positive, odd moduli.
178 */
179
180 /* Modular exponentiation wrt. N is always used for
181 * RSA public key operations. */
182 if( mbedtls_mpi_cmp_int( &ctx->N, 0 ) <= 0 ||
183 mbedtls_mpi_get_bit( &ctx->N, 0 ) == 0 )
184 {
185 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
186 }
187
188#if !defined(MBEDTLS_RSA_NO_CRT)
189 /* Modular exponentiation for P and Q is only
190 * used for private key operations and if CRT
191 * is used. */
192 if( is_priv &&
193 ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) <= 0 ||
194 mbedtls_mpi_get_bit( &ctx->P, 0 ) == 0 ||
195 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ||
196 mbedtls_mpi_get_bit( &ctx->Q, 0 ) == 0 ) )
197 {
198 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
199 }
200#endif /* !MBEDTLS_RSA_NO_CRT */
201
202 /*
203 * 2. Exponents must be positive
204 */
205
206 /* Always need E for public key operations */
207 if( mbedtls_mpi_cmp_int( &ctx->E, 0 ) <= 0 )
208 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
209
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100210#if defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker705fc682017-10-10 17:57:02 +0100211 /* For private key operations, use D or DP & DQ
212 * as (unblinded) exponents. */
213 if( is_priv && mbedtls_mpi_cmp_int( &ctx->D, 0 ) <= 0 )
214 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
215#else
216 if( is_priv &&
217 ( mbedtls_mpi_cmp_int( &ctx->DP, 0 ) <= 0 ||
218 mbedtls_mpi_cmp_int( &ctx->DQ, 0 ) <= 0 ) )
219 {
220 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
221 }
222#endif /* MBEDTLS_RSA_NO_CRT */
223
224 /* Blinding shouldn't make exponents negative either,
225 * so check that P, Q >= 1 if that hasn't yet been
226 * done as part of 1. */
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100227#if defined(MBEDTLS_RSA_NO_CRT)
Hanno Beckerebd2c022017-10-12 10:54:53 +0100228 if( is_priv && blinding_needed &&
Hanno Becker705fc682017-10-10 17:57:02 +0100229 ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) <= 0 ||
230 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ) )
231 {
232 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
233 }
234#endif
235
236 /* It wouldn't lead to an error if it wasn't satisfied,
Hanno Beckerf8c028a2017-10-17 09:20:57 +0100237 * but check for QP >= 1 nonetheless. */
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100238#if !defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker705fc682017-10-10 17:57:02 +0100239 if( is_priv &&
240 mbedtls_mpi_cmp_int( &ctx->QP, 0 ) <= 0 )
241 {
242 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
243 }
244#endif
245
246 return( 0 );
247}
248
Hanno Beckerf9e184b2017-10-10 16:49:26 +0100249int mbedtls_rsa_complete( mbedtls_rsa_context *ctx )
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100250{
251 int ret = 0;
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500252 int have_N, have_P, have_Q, have_D, have_E;
253#if !defined(MBEDTLS_RSA_NO_CRT)
254 int have_DP, have_DQ, have_QP;
255#endif
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500256 int n_missing, pq_missing, d_missing, is_pub, is_priv;
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100257
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500258 RSA_VALIDATE_RET( ctx != NULL );
259
260 have_N = ( mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 );
261 have_P = ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 );
262 have_Q = ( mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 );
263 have_D = ( mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 );
264 have_E = ( mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0 );
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500265
266#if !defined(MBEDTLS_RSA_NO_CRT)
Jack Lloyd80cc8112020-01-22 17:34:29 -0500267 have_DP = ( mbedtls_mpi_cmp_int( &ctx->DP, 0 ) != 0 );
268 have_DQ = ( mbedtls_mpi_cmp_int( &ctx->DQ, 0 ) != 0 );
269 have_QP = ( mbedtls_mpi_cmp_int( &ctx->QP, 0 ) != 0 );
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500270#endif
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100271
Hanno Becker617c1ae2017-08-23 14:11:24 +0100272 /*
273 * Check whether provided parameters are enough
274 * to deduce all others. The following incomplete
275 * parameter sets for private keys are supported:
276 *
277 * (1) P, Q missing.
278 * (2) D and potentially N missing.
279 *
280 */
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100281
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500282 n_missing = have_P && have_Q && have_D && have_E;
283 pq_missing = have_N && !have_P && !have_Q && have_D && have_E;
284 d_missing = have_P && have_Q && !have_D && have_E;
285 is_pub = have_N && !have_P && !have_Q && !have_D && have_E;
Hanno Becker2cca6f32017-09-29 11:46:40 +0100286
287 /* These three alternatives are mutually exclusive */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500288 is_priv = n_missing || pq_missing || d_missing;
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100289
Hanno Becker617c1ae2017-08-23 14:11:24 +0100290 if( !is_priv && !is_pub )
291 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
292
293 /*
Hanno Becker2cca6f32017-09-29 11:46:40 +0100294 * Step 1: Deduce N if P, Q are provided.
295 */
296
297 if( !have_N && have_P && have_Q )
298 {
299 if( ( ret = mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P,
300 &ctx->Q ) ) != 0 )
301 {
302 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
303 }
304
305 ctx->len = mbedtls_mpi_size( &ctx->N );
306 }
307
308 /*
309 * Step 2: Deduce and verify all remaining core parameters.
Hanno Becker617c1ae2017-08-23 14:11:24 +0100310 */
311
312 if( pq_missing )
313 {
Hanno Beckerc36aab62017-10-17 09:15:06 +0100314 ret = mbedtls_rsa_deduce_primes( &ctx->N, &ctx->E, &ctx->D,
Hanno Becker617c1ae2017-08-23 14:11:24 +0100315 &ctx->P, &ctx->Q );
316 if( ret != 0 )
317 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
318
319 }
320 else if( d_missing )
321 {
Hanno Becker8ba6ce42017-10-03 14:36:26 +0100322 if( ( ret = mbedtls_rsa_deduce_private_exponent( &ctx->P,
323 &ctx->Q,
324 &ctx->E,
325 &ctx->D ) ) != 0 )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100326 {
327 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
328 }
329 }
Hanno Becker617c1ae2017-08-23 14:11:24 +0100330
Hanno Becker617c1ae2017-08-23 14:11:24 +0100331 /*
Hanno Becker2cca6f32017-09-29 11:46:40 +0100332 * Step 3: Deduce all additional parameters specific
Hanno Beckere8674892017-10-10 17:56:14 +0100333 * to our current RSA implementation.
Hanno Becker617c1ae2017-08-23 14:11:24 +0100334 */
335
Hanno Becker23344b52017-08-23 07:43:27 +0100336#if !defined(MBEDTLS_RSA_NO_CRT)
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500337 if( is_priv && ! ( have_DP && have_DQ && have_QP ) )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100338 {
339 ret = mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
340 &ctx->DP, &ctx->DQ, &ctx->QP );
341 if( ret != 0 )
342 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
343 }
Hanno Becker23344b52017-08-23 07:43:27 +0100344#endif /* MBEDTLS_RSA_NO_CRT */
Hanno Becker617c1ae2017-08-23 14:11:24 +0100345
346 /*
Hanno Becker705fc682017-10-10 17:57:02 +0100347 * Step 3: Basic sanity checks
Hanno Becker617c1ae2017-08-23 14:11:24 +0100348 */
349
Hanno Beckerebd2c022017-10-12 10:54:53 +0100350 return( rsa_check_context( ctx, is_priv, 1 ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100351}
352
Hanno Becker617c1ae2017-08-23 14:11:24 +0100353int mbedtls_rsa_export_raw( const mbedtls_rsa_context *ctx,
354 unsigned char *N, size_t N_len,
355 unsigned char *P, size_t P_len,
356 unsigned char *Q, size_t Q_len,
357 unsigned char *D, size_t D_len,
358 unsigned char *E, size_t E_len )
359{
360 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500361 int is_priv;
362 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100363
364 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500365 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100366 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
367 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
368 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
369 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
370 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
371
372 if( !is_priv )
373 {
374 /* If we're trying to export private parameters for a public key,
375 * something must be wrong. */
376 if( P != NULL || Q != NULL || D != NULL )
377 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
378
379 }
380
381 if( N != NULL )
382 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->N, N, N_len ) );
383
384 if( P != NULL )
385 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->P, P, P_len ) );
386
387 if( Q != NULL )
388 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->Q, Q, Q_len ) );
389
390 if( D != NULL )
391 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->D, D, D_len ) );
392
393 if( E != NULL )
394 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->E, E, E_len ) );
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100395
396cleanup:
397
398 return( ret );
399}
400
Hanno Becker617c1ae2017-08-23 14:11:24 +0100401int mbedtls_rsa_export( const mbedtls_rsa_context *ctx,
402 mbedtls_mpi *N, mbedtls_mpi *P, mbedtls_mpi *Q,
403 mbedtls_mpi *D, mbedtls_mpi *E )
404{
Janos Follath24eed8d2019-11-22 13:21:35 +0000405 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500406 int is_priv;
407 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100408
409 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500410 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100411 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
412 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
413 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
414 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
415 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
416
417 if( !is_priv )
418 {
419 /* If we're trying to export private parameters for a public key,
420 * something must be wrong. */
421 if( P != NULL || Q != NULL || D != NULL )
422 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
423
424 }
425
426 /* Export all requested core parameters. */
427
428 if( ( N != NULL && ( ret = mbedtls_mpi_copy( N, &ctx->N ) ) != 0 ) ||
429 ( P != NULL && ( ret = mbedtls_mpi_copy( P, &ctx->P ) ) != 0 ) ||
430 ( Q != NULL && ( ret = mbedtls_mpi_copy( Q, &ctx->Q ) ) != 0 ) ||
431 ( D != NULL && ( ret = mbedtls_mpi_copy( D, &ctx->D ) ) != 0 ) ||
432 ( E != NULL && ( ret = mbedtls_mpi_copy( E, &ctx->E ) ) != 0 ) )
433 {
434 return( ret );
435 }
436
437 return( 0 );
438}
439
440/*
441 * Export CRT parameters
442 * This must also be implemented if CRT is not used, for being able to
443 * write DER encoded RSA keys. The helper function mbedtls_rsa_deduce_crt
444 * can be used in this case.
445 */
446int mbedtls_rsa_export_crt( const mbedtls_rsa_context *ctx,
447 mbedtls_mpi *DP, mbedtls_mpi *DQ, mbedtls_mpi *QP )
448{
Janos Follath24eed8d2019-11-22 13:21:35 +0000449 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500450 int is_priv;
451 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100452
453 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500454 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100455 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
456 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
457 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
458 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
459 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
460
461 if( !is_priv )
462 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
463
Hanno Beckerdc95c892017-08-23 06:57:02 +0100464#if !defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker617c1ae2017-08-23 14:11:24 +0100465 /* Export all requested blinding parameters. */
Hanno Becker617c1ae2017-08-23 14:11:24 +0100466 if( ( DP != NULL && ( ret = mbedtls_mpi_copy( DP, &ctx->DP ) ) != 0 ) ||
467 ( DQ != NULL && ( ret = mbedtls_mpi_copy( DQ, &ctx->DQ ) ) != 0 ) ||
468 ( QP != NULL && ( ret = mbedtls_mpi_copy( QP, &ctx->QP ) ) != 0 ) )
469 {
Hanno Beckerdc95c892017-08-23 06:57:02 +0100470 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100471 }
Hanno Beckerdc95c892017-08-23 06:57:02 +0100472#else
473 if( ( ret = mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
474 DP, DQ, QP ) ) != 0 )
475 {
476 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA + ret );
477 }
478#endif
Hanno Becker617c1ae2017-08-23 14:11:24 +0100479
480 return( 0 );
481}
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100482
Paul Bakker5121ce52009-01-03 21:22:43 +0000483/*
484 * Initialize an RSA context
485 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200486void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
Paul Bakker5121ce52009-01-03 21:22:43 +0000487 int padding,
Paul Bakker21eb2802010-08-16 11:10:02 +0000488 int hash_id )
Paul Bakker5121ce52009-01-03 21:22:43 +0000489{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500490 RSA_VALIDATE( ctx != NULL );
491 RSA_VALIDATE( padding == MBEDTLS_RSA_PKCS_V15 ||
492 padding == MBEDTLS_RSA_PKCS_V21 );
493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200494 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000495
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200496 mbedtls_rsa_set_padding( ctx, padding, hash_id );
Paul Bakkerc9965dc2013-09-29 14:58:17 +0200497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200498#if defined(MBEDTLS_THREADING_C)
499 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerc9965dc2013-09-29 14:58:17 +0200500#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000501}
502
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100503/*
504 * Set padding for an existing RSA context
505 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500506void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding,
507 int hash_id )
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100508{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500509 RSA_VALIDATE( ctx != NULL );
510 RSA_VALIDATE( padding == MBEDTLS_RSA_PKCS_V15 ||
511 padding == MBEDTLS_RSA_PKCS_V21 );
512
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100513 ctx->padding = padding;
514 ctx->hash_id = hash_id;
515}
516
Hanno Becker617c1ae2017-08-23 14:11:24 +0100517/*
518 * Get length in bytes of RSA modulus
519 */
520
521size_t mbedtls_rsa_get_len( const mbedtls_rsa_context *ctx )
522{
Hanno Becker2f8f06a2017-09-29 11:47:26 +0100523 return( ctx->len );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100524}
525
526
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200527#if defined(MBEDTLS_GENPRIME)
Paul Bakker5121ce52009-01-03 21:22:43 +0000528
529/*
530 * Generate an RSA keypair
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800531 *
532 * This generation method follows the RSA key pair generation procedure of
533 * FIPS 186-4 if 2^16 < exponent < 2^256 and nbits = 2048 or nbits = 3072.
Paul Bakker5121ce52009-01-03 21:22:43 +0000534 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200535int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000536 int (*f_rng)(void *, unsigned char *, size_t),
537 void *p_rng,
538 unsigned int nbits, int exponent )
Paul Bakker5121ce52009-01-03 21:22:43 +0000539{
Janos Follath24eed8d2019-11-22 13:21:35 +0000540 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jethro Beekman97f95c92018-02-13 15:50:36 -0800541 mbedtls_mpi H, G, L;
Janos Follathb8fc1b02018-09-03 15:37:01 +0100542 int prime_quality = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500543 RSA_VALIDATE_RET( ctx != NULL );
544 RSA_VALIDATE_RET( f_rng != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000545
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500546 if( nbits < 128 || exponent < 3 || nbits % 2 != 0 )
Janos Follathef441782016-09-21 13:18:12 +0100547 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
548
Janos Follathb8fc1b02018-09-03 15:37:01 +0100549 /*
550 * If the modulus is 1024 bit long or shorter, then the security strength of
551 * the RSA algorithm is less than or equal to 80 bits and therefore an error
552 * rate of 2^-80 is sufficient.
553 */
554 if( nbits > 1024 )
555 prime_quality = MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR;
556
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100557 mbedtls_mpi_init( &H );
558 mbedtls_mpi_init( &G );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800559 mbedtls_mpi_init( &L );
Paul Bakker5121ce52009-01-03 21:22:43 +0000560
561 /*
562 * find primes P and Q with Q < P so that:
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800563 * 1. |P-Q| > 2^( nbits / 2 - 100 )
564 * 2. GCD( E, (P-1)*(Q-1) ) == 1
565 * 3. E^-1 mod LCM(P-1, Q-1) > 2^( nbits / 2 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000566 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200567 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000568
569 do
570 {
Janos Follathb8fc1b02018-09-03 15:37:01 +0100571 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1,
572 prime_quality, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000573
Janos Follathb8fc1b02018-09-03 15:37:01 +0100574 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1,
575 prime_quality, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000576
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800577 /* make sure the difference between p and q is not too small (FIPS 186-4 §B.3.3 step 5.4) */
578 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &H, &ctx->P, &ctx->Q ) );
579 if( mbedtls_mpi_bitlen( &H ) <= ( ( nbits >= 200 ) ? ( ( nbits >> 1 ) - 99 ) : 0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +0000580 continue;
581
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800582 /* not required by any standards, but some users rely on the fact that P > Q */
583 if( H.s < 0 )
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100584 mbedtls_mpi_swap( &ctx->P, &ctx->Q );
Janos Follathef441782016-09-21 13:18:12 +0100585
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100586 /* Temporarily replace P,Q by P-1, Q-1 */
587 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &ctx->P, &ctx->P, 1 ) );
588 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &ctx->Q, &ctx->Q, 1 ) );
589 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &ctx->P, &ctx->Q ) );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800590
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800591 /* check GCD( E, (P-1)*(Q-1) ) == 1 (FIPS 186-4 §B.3.1 criterion 2(a)) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200592 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800593 if( mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
594 continue;
595
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800596 /* compute smallest possible D = E^-1 mod LCM(P-1, Q-1) (FIPS 186-4 §B.3.1 criterion 3(b)) */
Jethro Beekman97f95c92018-02-13 15:50:36 -0800597 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->P, &ctx->Q ) );
598 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L, NULL, &H, &G ) );
599 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D, &ctx->E, &L ) );
600
601 if( mbedtls_mpi_bitlen( &ctx->D ) <= ( ( nbits + 1 ) / 2 ) ) // (FIPS 186-4 §B.3.1 criterion 3(a))
602 continue;
603
604 break;
Paul Bakker5121ce52009-01-03 21:22:43 +0000605 }
Jethro Beekman97f95c92018-02-13 15:50:36 -0800606 while( 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000607
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100608 /* Restore P,Q */
609 MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &ctx->P, &ctx->P, 1 ) );
610 MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &ctx->Q, &ctx->Q, 1 ) );
611
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800612 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
613
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100614 ctx->len = mbedtls_mpi_size( &ctx->N );
615
Jethro Beekman97f95c92018-02-13 15:50:36 -0800616#if !defined(MBEDTLS_RSA_NO_CRT)
Paul Bakker5121ce52009-01-03 21:22:43 +0000617 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000618 * DP = D mod (P - 1)
619 * DQ = D mod (Q - 1)
620 * QP = Q^-1 mod P
621 */
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100622 MBEDTLS_MPI_CHK( mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
623 &ctx->DP, &ctx->DQ, &ctx->QP ) );
624#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakker5121ce52009-01-03 21:22:43 +0000625
Hanno Becker83aad1f2017-08-23 06:45:10 +0100626 /* Double-check */
627 MBEDTLS_MPI_CHK( mbedtls_rsa_check_privkey( ctx ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000628
629cleanup:
630
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100631 mbedtls_mpi_free( &H );
632 mbedtls_mpi_free( &G );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800633 mbedtls_mpi_free( &L );
Paul Bakker5121ce52009-01-03 21:22:43 +0000634
635 if( ret != 0 )
636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200637 mbedtls_rsa_free( ctx );
638 return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000639 }
640
Paul Bakker48377d92013-08-30 12:06:24 +0200641 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000642}
643
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644#endif /* MBEDTLS_GENPRIME */
Paul Bakker5121ce52009-01-03 21:22:43 +0000645
646/*
647 * Check a public RSA key
648 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200649int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000650{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500651 RSA_VALIDATE_RET( ctx != NULL );
652
Hanno Beckerebd2c022017-10-12 10:54:53 +0100653 if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker37940d9f2009-07-10 22:38:58 +0000655
Hanno Becker3a760a12018-01-05 08:14:49 +0000656 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 )
Hanno Becker98838b02017-10-02 13:16:10 +0100657 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200658 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Hanno Becker98838b02017-10-02 13:16:10 +0100659 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000660
Hanno Becker705fc682017-10-10 17:57:02 +0100661 if( mbedtls_mpi_get_bit( &ctx->E, 0 ) == 0 ||
662 mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200663 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
Hanno Becker98838b02017-10-02 13:16:10 +0100664 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200665 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Hanno Becker98838b02017-10-02 13:16:10 +0100666 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000667
668 return( 0 );
669}
670
671/*
Hanno Becker705fc682017-10-10 17:57:02 +0100672 * Check for the consistency of all fields in an RSA private key context
Paul Bakker5121ce52009-01-03 21:22:43 +0000673 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000675{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500676 RSA_VALIDATE_RET( ctx != NULL );
677
Hanno Becker705fc682017-10-10 17:57:02 +0100678 if( mbedtls_rsa_check_pubkey( ctx ) != 0 ||
Hanno Beckerebd2c022017-10-12 10:54:53 +0100679 rsa_check_context( ctx, 1 /* private */, 1 /* blinding */ ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000680 {
Hanno Becker98838b02017-10-02 13:16:10 +0100681 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000682 }
Paul Bakker48377d92013-08-30 12:06:24 +0200683
Hanno Becker98838b02017-10-02 13:16:10 +0100684 if( mbedtls_rsa_validate_params( &ctx->N, &ctx->P, &ctx->Q,
Hanno Beckerb269a852017-08-25 08:03:21 +0100685 &ctx->D, &ctx->E, NULL, NULL ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000686 {
Hanno Beckerb269a852017-08-25 08:03:21 +0100687 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000688 }
Paul Bakker6c591fa2011-05-05 11:49:20 +0000689
Hanno Beckerb269a852017-08-25 08:03:21 +0100690#if !defined(MBEDTLS_RSA_NO_CRT)
691 else if( mbedtls_rsa_validate_crt( &ctx->P, &ctx->Q, &ctx->D,
692 &ctx->DP, &ctx->DQ, &ctx->QP ) != 0 )
693 {
694 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
695 }
696#endif
Paul Bakker6c591fa2011-05-05 11:49:20 +0000697
698 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000699}
700
701/*
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100702 * Check if contexts holding a public and private key match
703 */
Hanno Becker98838b02017-10-02 13:16:10 +0100704int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub,
705 const mbedtls_rsa_context *prv )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100706{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500707 RSA_VALIDATE_RET( pub != NULL );
708 RSA_VALIDATE_RET( prv != NULL );
709
Hanno Becker98838b02017-10-02 13:16:10 +0100710 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711 mbedtls_rsa_check_privkey( prv ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100712 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100714 }
715
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200716 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
717 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100718 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200719 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100720 }
721
722 return( 0 );
723}
724
725/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000726 * Do an RSA public key operation
727 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200728int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000729 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000730 unsigned char *output )
731{
Janos Follath24eed8d2019-11-22 13:21:35 +0000732 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +0000733 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 mbedtls_mpi T;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500735 RSA_VALIDATE_RET( ctx != NULL );
736 RSA_VALIDATE_RET( input != NULL );
737 RSA_VALIDATE_RET( output != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000738
Hanno Beckerebd2c022017-10-12 10:54:53 +0100739 if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) )
Hanno Becker705fc682017-10-10 17:57:02 +0100740 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200742 mbedtls_mpi_init( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000743
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200744#if defined(MBEDTLS_THREADING_C)
745 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
746 return( ret );
747#endif
748
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200749 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000750
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200751 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000752 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200753 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
754 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000755 }
756
757 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200758 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
759 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000760
761cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200762#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200763 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
764 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnard88fca3e2015-03-27 15:06:07 +0100765#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200767 mbedtls_mpi_free( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000768
769 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200770 return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000771
772 return( 0 );
773}
774
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200775/*
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200776 * Generate or update blinding values, see section 10 of:
777 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +0200778 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200779 * Berlin Heidelberg, 1996. p. 104-113.
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200780 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200781static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200782 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
783{
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200784 int ret, count = 0;
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200785 mbedtls_mpi R;
786
787 mbedtls_mpi_init( &R );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200788
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200789 if( ctx->Vf.p != NULL )
790 {
791 /* We already have blinding values, just update them by squaring */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200792 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
793 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
794 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
795 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200796
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200797 goto cleanup;
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200798 }
799
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200800 /* Unblinding value: Vf = random number, invertible mod N */
801 do {
802 if( count++ > 10 )
Manuel Pégourié-Gonnarde288ec02020-07-16 09:23:30 +0200803 {
804 ret = MBEDTLS_ERR_RSA_RNG_FAILED;
805 goto cleanup;
806 }
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200807
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200808 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
Manuel Pégourié-Gonnardb3e3d792020-06-26 11:03:19 +0200809
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200810 /* Compute Vf^-1 as R * (R Vf)^-1 to avoid leaks from inv_mod. */
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200811 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, ctx->len - 1, f_rng, p_rng ) );
812 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vf, &R ) );
813 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
814
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200815 /* At this point, Vi is invertible mod N if and only if both Vf and R
816 * are invertible mod N. If one of them isn't, we don't need to know
817 * which one, we just loop and choose new values for both of them.
818 * (Each iteration succeeds with overwhelming probability.) */
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200819 ret = mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vi, &ctx->N );
820 if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
821 continue;
822 if( ret != 0 )
Manuel Pégourié-Gonnardb3e3d792020-06-26 11:03:19 +0200823 goto cleanup;
824
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200825 /* Finish the computation of Vf^-1 = R * (R Vf)^-1 */
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200826 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &R ) );
827 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
828 } while( 0 );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200829
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200830 /* Blinding value: Vi = Vf^(-e) mod N
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200831 * (Vi already contains Vf^-1 at this point) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200832 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200833
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +0200834
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200835cleanup:
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200836 mbedtls_mpi_free( &R );
837
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200838 return( ret );
839}
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200840
Paul Bakker5121ce52009-01-03 21:22:43 +0000841/*
Janos Follathe81102e2017-03-22 13:38:28 +0000842 * Exponent blinding supposed to prevent side-channel attacks using multiple
843 * traces of measurements to recover the RSA key. The more collisions are there,
844 * the more bits of the key can be recovered. See [3].
845 *
846 * Collecting n collisions with m bit long blinding value requires 2^(m-m/n)
847 * observations on avarage.
848 *
849 * For example with 28 byte blinding to achieve 2 collisions the adversary has
850 * to make 2^112 observations on avarage.
851 *
852 * (With the currently (as of 2017 April) known best algorithms breaking 2048
853 * bit RSA requires approximately as much time as trying out 2^112 random keys.
854 * Thus in this sense with 28 byte blinding the security is not reduced by
855 * side-channel attacks like the one in [3])
856 *
857 * This countermeasure does not help if the key recovery is possible with a
858 * single trace.
859 */
860#define RSA_EXPONENT_BLINDING 28
861
862/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000863 * Do an RSA private key operation
864 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200865int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +0200866 int (*f_rng)(void *, unsigned char *, size_t),
867 void *p_rng,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000868 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000869 unsigned char *output )
870{
Janos Follath24eed8d2019-11-22 13:21:35 +0000871 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +0000872 size_t olen;
Hanno Becker06811ce2017-05-03 15:10:34 +0100873
874 /* Temporary holding the result */
875 mbedtls_mpi T;
876
877 /* Temporaries holding P-1, Q-1 and the
878 * exponent blinding factor, respectively. */
Janos Follathf9203b42017-03-22 15:13:15 +0000879 mbedtls_mpi P1, Q1, R;
Hanno Becker06811ce2017-05-03 15:10:34 +0100880
881#if !defined(MBEDTLS_RSA_NO_CRT)
882 /* Temporaries holding the results mod p resp. mod q. */
883 mbedtls_mpi TP, TQ;
884
885 /* Temporaries holding the blinded exponents for
886 * the mod p resp. mod q computation (if used). */
Janos Follathf9203b42017-03-22 15:13:15 +0000887 mbedtls_mpi DP_blind, DQ_blind;
Hanno Becker06811ce2017-05-03 15:10:34 +0100888
889 /* Pointers to actual exponents to be used - either the unblinded
890 * or the blinded ones, depending on the presence of a PRNG. */
Janos Follathf9203b42017-03-22 15:13:15 +0000891 mbedtls_mpi *DP = &ctx->DP;
892 mbedtls_mpi *DQ = &ctx->DQ;
Hanno Becker06811ce2017-05-03 15:10:34 +0100893#else
894 /* Temporary holding the blinded exponent (if used). */
895 mbedtls_mpi D_blind;
896
897 /* Pointer to actual exponent to be used - either the unblinded
898 * or the blinded one, depending on the presence of a PRNG. */
899 mbedtls_mpi *D = &ctx->D;
Hanno Becker43f94722017-08-25 11:50:00 +0100900#endif /* MBEDTLS_RSA_NO_CRT */
Hanno Becker06811ce2017-05-03 15:10:34 +0100901
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100902 /* Temporaries holding the initial input and the double
903 * checked result; should be the same in the end. */
904 mbedtls_mpi I, C;
Paul Bakker5121ce52009-01-03 21:22:43 +0000905
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500906 RSA_VALIDATE_RET( ctx != NULL );
907 RSA_VALIDATE_RET( input != NULL );
908 RSA_VALIDATE_RET( output != NULL );
909
Hanno Beckerebd2c022017-10-12 10:54:53 +0100910 if( rsa_check_context( ctx, 1 /* private key checks */,
911 f_rng != NULL /* blinding y/n */ ) != 0 )
912 {
Manuel Pégourié-Gonnardfb84d382015-10-30 10:56:25 +0100913 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Hanno Beckerebd2c022017-10-12 10:54:53 +0100914 }
Manuel Pégourié-Gonnardfb84d382015-10-30 10:56:25 +0100915
Hanno Becker06811ce2017-05-03 15:10:34 +0100916#if defined(MBEDTLS_THREADING_C)
917 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
918 return( ret );
919#endif
Janos Follathf9203b42017-03-22 15:13:15 +0000920
Hanno Becker06811ce2017-05-03 15:10:34 +0100921 /* MPI Initialization */
Hanno Becker06811ce2017-05-03 15:10:34 +0100922 mbedtls_mpi_init( &T );
923
924 mbedtls_mpi_init( &P1 );
925 mbedtls_mpi_init( &Q1 );
926 mbedtls_mpi_init( &R );
Janos Follathf9203b42017-03-22 15:13:15 +0000927
Janos Follathf9203b42017-03-22 15:13:15 +0000928 if( f_rng != NULL )
929 {
Janos Follathe81102e2017-03-22 13:38:28 +0000930#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follathf9203b42017-03-22 15:13:15 +0000931 mbedtls_mpi_init( &D_blind );
932#else
933 mbedtls_mpi_init( &DP_blind );
934 mbedtls_mpi_init( &DQ_blind );
Janos Follathe81102e2017-03-22 13:38:28 +0000935#endif
Janos Follathf9203b42017-03-22 15:13:15 +0000936 }
Janos Follathe81102e2017-03-22 13:38:28 +0000937
Hanno Becker06811ce2017-05-03 15:10:34 +0100938#if !defined(MBEDTLS_RSA_NO_CRT)
939 mbedtls_mpi_init( &TP ); mbedtls_mpi_init( &TQ );
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200940#endif
941
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100942 mbedtls_mpi_init( &I );
943 mbedtls_mpi_init( &C );
Hanno Becker06811ce2017-05-03 15:10:34 +0100944
945 /* End of MPI initialization */
946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200947 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
948 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000949 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200950 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
951 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000952 }
953
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100954 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &I, &T ) );
Hanno Becker06811ce2017-05-03 15:10:34 +0100955
Paul Bakkerf451bac2013-08-30 15:37:02 +0200956 if( f_rng != NULL )
957 {
958 /*
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200959 * Blinding
960 * T = T * Vi mod N
Paul Bakkerf451bac2013-08-30 15:37:02 +0200961 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200962 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
963 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200964 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Janos Follathe81102e2017-03-22 13:38:28 +0000965
Janos Follathe81102e2017-03-22 13:38:28 +0000966 /*
967 * Exponent blinding
968 */
969 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
970 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
971
Janos Follathf9203b42017-03-22 15:13:15 +0000972#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follathe81102e2017-03-22 13:38:28 +0000973 /*
974 * D_blind = ( P - 1 ) * ( Q - 1 ) * R + D
975 */
976 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
977 f_rng, p_rng ) );
978 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &P1, &Q1 ) );
979 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &D_blind, &R ) );
980 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &D_blind, &D_blind, &ctx->D ) );
981
982 D = &D_blind;
Janos Follathf9203b42017-03-22 15:13:15 +0000983#else
984 /*
985 * DP_blind = ( P - 1 ) * R + DP
986 */
987 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
988 f_rng, p_rng ) );
989 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DP_blind, &P1, &R ) );
990 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DP_blind, &DP_blind,
991 &ctx->DP ) );
992
993 DP = &DP_blind;
994
995 /*
996 * DQ_blind = ( Q - 1 ) * R + DQ
997 */
998 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
999 f_rng, p_rng ) );
1000 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DQ_blind, &Q1, &R ) );
1001 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DQ_blind, &DQ_blind,
1002 &ctx->DQ ) );
1003
1004 DQ = &DQ_blind;
Janos Follathe81102e2017-03-22 13:38:28 +00001005#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkerf451bac2013-08-30 15:37:02 +02001006 }
Paul Bakkeraab30c12013-08-30 11:00:25 +02001007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001008#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follathe81102e2017-03-22 13:38:28 +00001009 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, D, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnarde10e06d2014-11-06 18:15:12 +01001010#else
Paul Bakkeraab30c12013-08-30 11:00:25 +02001011 /*
Janos Follathe81102e2017-03-22 13:38:28 +00001012 * Faster decryption using the CRT
Paul Bakker5121ce52009-01-03 21:22:43 +00001013 *
Hanno Becker06811ce2017-05-03 15:10:34 +01001014 * TP = input ^ dP mod P
1015 * TQ = input ^ dQ mod Q
Paul Bakker5121ce52009-01-03 21:22:43 +00001016 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001017
1018 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &TP, &T, DP, &ctx->P, &ctx->RP ) );
1019 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &TQ, &T, DQ, &ctx->Q, &ctx->RQ ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001020
1021 /*
Hanno Becker06811ce2017-05-03 15:10:34 +01001022 * T = (TP - TQ) * (Q^-1 mod P) mod P
Paul Bakker5121ce52009-01-03 21:22:43 +00001023 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001024 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &TP, &TQ ) );
1025 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &TP, &T, &ctx->QP ) );
1026 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &TP, &ctx->P ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001027
1028 /*
Hanno Becker06811ce2017-05-03 15:10:34 +01001029 * T = TQ + T * Q
Paul Bakker5121ce52009-01-03 21:22:43 +00001030 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001031 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &TP, &T, &ctx->Q ) );
1032 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &TQ, &TP ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkeraab30c12013-08-30 11:00:25 +02001034
Paul Bakkerf451bac2013-08-30 15:37:02 +02001035 if( f_rng != NULL )
1036 {
1037 /*
1038 * Unblind
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +02001039 * T = T * Vf mod N
Paul Bakkerf451bac2013-08-30 15:37:02 +02001040 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +02001041 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Paul Bakkerf451bac2013-08-30 15:37:02 +02001043 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001044
Hanno Becker2dec5e82017-10-03 07:49:52 +01001045 /* Verify the result to prevent glitching attacks. */
1046 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &C, &T, &ctx->E,
1047 &ctx->N, &ctx->RN ) );
Hanno Beckerc6075cc2017-08-25 11:45:35 +01001048 if( mbedtls_mpi_cmp_mpi( &C, &I ) != 0 )
Hanno Becker06811ce2017-05-03 15:10:34 +01001049 {
Hanno Becker06811ce2017-05-03 15:10:34 +01001050 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
1051 goto cleanup;
1052 }
Hanno Becker06811ce2017-05-03 15:10:34 +01001053
Paul Bakker5121ce52009-01-03 21:22:43 +00001054 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001055 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001056
1057cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +02001059 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
1060 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +02001061#endif
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +02001062
Hanno Becker06811ce2017-05-03 15:10:34 +01001063 mbedtls_mpi_free( &P1 );
1064 mbedtls_mpi_free( &Q1 );
1065 mbedtls_mpi_free( &R );
Janos Follathf9203b42017-03-22 15:13:15 +00001066
1067 if( f_rng != NULL )
1068 {
Janos Follathe81102e2017-03-22 13:38:28 +00001069#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follathf9203b42017-03-22 15:13:15 +00001070 mbedtls_mpi_free( &D_blind );
1071#else
1072 mbedtls_mpi_free( &DP_blind );
1073 mbedtls_mpi_free( &DQ_blind );
Janos Follathe81102e2017-03-22 13:38:28 +00001074#endif
Janos Follathf9203b42017-03-22 15:13:15 +00001075 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001076
Hanno Becker06811ce2017-05-03 15:10:34 +01001077 mbedtls_mpi_free( &T );
1078
1079#if !defined(MBEDTLS_RSA_NO_CRT)
1080 mbedtls_mpi_free( &TP ); mbedtls_mpi_free( &TQ );
1081#endif
1082
Hanno Beckerc6075cc2017-08-25 11:45:35 +01001083 mbedtls_mpi_free( &C );
1084 mbedtls_mpi_free( &I );
Hanno Becker06811ce2017-05-03 15:10:34 +01001085
Paul Bakker5121ce52009-01-03 21:22:43 +00001086 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001087 return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001088
1089 return( 0 );
1090}
1091
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001092#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker9dcc3222011-03-08 14:16:06 +00001093/**
1094 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
1095 *
Paul Bakkerb125ed82011-11-10 13:33:51 +00001096 * \param dst buffer to mask
1097 * \param dlen length of destination buffer
1098 * \param src source of the mask generation
1099 * \param slen length of the source buffer
1100 * \param md_ctx message digest context to use
Paul Bakker9dcc3222011-03-08 14:16:06 +00001101 */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001102static int mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103 size_t slen, mbedtls_md_context_t *md_ctx )
Paul Bakker9dcc3222011-03-08 14:16:06 +00001104{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +00001106 unsigned char counter[4];
1107 unsigned char *p;
Paul Bakker23986e52011-04-24 08:57:21 +00001108 unsigned int hlen;
1109 size_t i, use_len;
Andres Amaya Garcia94682d12017-07-20 14:26:37 +01001110 int ret = 0;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001113 memset( counter, 0, 4 );
1114
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001115 hlen = mbedtls_md_get_size( md_ctx->md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001116
Simon Butcher02037452016-03-01 21:19:12 +00001117 /* Generate and apply dbMask */
Paul Bakker9dcc3222011-03-08 14:16:06 +00001118 p = dst;
1119
1120 while( dlen > 0 )
1121 {
1122 use_len = hlen;
1123 if( dlen < hlen )
1124 use_len = dlen;
1125
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001126 if( ( ret = mbedtls_md_starts( md_ctx ) ) != 0 )
1127 goto exit;
1128 if( ( ret = mbedtls_md_update( md_ctx, src, slen ) ) != 0 )
1129 goto exit;
1130 if( ( ret = mbedtls_md_update( md_ctx, counter, 4 ) ) != 0 )
1131 goto exit;
1132 if( ( ret = mbedtls_md_finish( md_ctx, mask ) ) != 0 )
1133 goto exit;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001134
1135 for( i = 0; i < use_len; ++i )
1136 *p++ ^= mask[i];
1137
1138 counter[3]++;
1139
1140 dlen -= use_len;
1141 }
Gilles Peskine18ac7162017-05-05 19:24:06 +02001142
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001143exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001144 mbedtls_platform_zeroize( mask, sizeof( mask ) );
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001145
1146 return( ret );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001147}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001148#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker9dcc3222011-03-08 14:16:06 +00001149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001150#if defined(MBEDTLS_PKCS1_V21)
Paul Bakkerb3869132013-02-28 17:21:01 +01001151/*
1152 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
1153 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001154int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001155 int (*f_rng)(void *, unsigned char *, size_t),
1156 void *p_rng,
Paul Bakkera43231c2013-02-28 17:33:49 +01001157 int mode,
1158 const unsigned char *label, size_t label_len,
1159 size_t ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001160 const unsigned char *input,
1161 unsigned char *output )
1162{
1163 size_t olen;
Janos Follath24eed8d2019-11-22 13:21:35 +00001164 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001165 unsigned char *p = output;
1166 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167 const mbedtls_md_info_t *md_info;
1168 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001169
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001170 RSA_VALIDATE_RET( ctx != NULL );
1171 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1172 mode == MBEDTLS_RSA_PUBLIC );
1173 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001174 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001175 RSA_VALIDATE_RET( label_len == 0 || label != NULL );
1176
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001177 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1178 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001179
1180 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001181 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001182
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001183 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001184 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001186
1187 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001189
Simon Butcher02037452016-03-01 21:19:12 +00001190 /* first comparison checks for overflow */
Janos Follatheddfe8f2016-02-08 14:52:29 +00001191 if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001193
1194 memset( output, 0, olen );
1195
1196 *p++ = 0;
1197
Simon Butcher02037452016-03-01 21:19:12 +00001198 /* Generate a random octet string seed */
Paul Bakkerb3869132013-02-28 17:21:01 +01001199 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001200 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001201
1202 p += hlen;
1203
Simon Butcher02037452016-03-01 21:19:12 +00001204 /* Construct DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001205 if( ( ret = mbedtls_md( md_info, label, label_len, p ) ) != 0 )
1206 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001207 p += hlen;
1208 p += olen - 2 * hlen - 2 - ilen;
1209 *p++ = 1;
Gilles Peskine004f87b2018-07-06 15:47:54 +02001210 if( ilen != 0 )
1211 memcpy( p, input, ilen );
Paul Bakkerb3869132013-02-28 17:21:01 +01001212
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001213 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001214 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001215 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001216
Simon Butcher02037452016-03-01 21:19:12 +00001217 /* maskedDB: Apply dbMask to DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001218 if( ( ret = mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
1219 &md_ctx ) ) != 0 )
1220 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001221
Simon Butcher02037452016-03-01 21:19:12 +00001222 /* maskedSeed: Apply seedMask to seed */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001223 if( ( ret = mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
1224 &md_ctx ) ) != 0 )
1225 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001226
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001227exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001228 mbedtls_md_free( &md_ctx );
Paul Bakkerb3869132013-02-28 17:21:01 +01001229
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001230 if( ret != 0 )
1231 return( ret );
1232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001233 return( ( mode == MBEDTLS_RSA_PUBLIC )
1234 ? mbedtls_rsa_public( ctx, output, output )
1235 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001236}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001237#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001239#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001240/*
1241 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
1242 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001244 int (*f_rng)(void *, unsigned char *, size_t),
1245 void *p_rng,
1246 int mode, size_t ilen,
1247 const unsigned char *input,
1248 unsigned char *output )
1249{
1250 size_t nb_pad, olen;
Janos Follath24eed8d2019-11-22 13:21:35 +00001251 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001252 unsigned char *p = output;
1253
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001254 RSA_VALIDATE_RET( ctx != NULL );
1255 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1256 mode == MBEDTLS_RSA_PUBLIC );
1257 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001258 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001259
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001260 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001261 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001262
1263 olen = ctx->len;
Manuel Pégourié-Gonnard370717b2016-02-11 10:35:13 +01001264
Simon Butcher02037452016-03-01 21:19:12 +00001265 /* first comparison checks for overflow */
Janos Follatheddfe8f2016-02-08 14:52:29 +00001266 if( ilen + 11 < ilen || olen < ilen + 11 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001267 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001268
1269 nb_pad = olen - 3 - ilen;
1270
1271 *p++ = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001272 if( mode == MBEDTLS_RSA_PUBLIC )
Paul Bakkerb3869132013-02-28 17:21:01 +01001273 {
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001274 if( f_rng == NULL )
1275 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1276
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001277 *p++ = MBEDTLS_RSA_CRYPT;
Paul Bakkerb3869132013-02-28 17:21:01 +01001278
1279 while( nb_pad-- > 0 )
1280 {
1281 int rng_dl = 100;
1282
1283 do {
1284 ret = f_rng( p_rng, p, 1 );
1285 } while( *p == 0 && --rng_dl && ret == 0 );
1286
Simon Butcher02037452016-03-01 21:19:12 +00001287 /* Check if RNG failed to generate data */
Paul Bakker66d5d072014-06-17 16:39:18 +02001288 if( rng_dl == 0 || ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001290
1291 p++;
1292 }
1293 }
1294 else
1295 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001296 *p++ = MBEDTLS_RSA_SIGN;
Paul Bakkerb3869132013-02-28 17:21:01 +01001297
1298 while( nb_pad-- > 0 )
1299 *p++ = 0xFF;
1300 }
1301
1302 *p++ = 0;
Gilles Peskine004f87b2018-07-06 15:47:54 +02001303 if( ilen != 0 )
1304 memcpy( p, input, ilen );
Paul Bakkerb3869132013-02-28 17:21:01 +01001305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306 return( ( mode == MBEDTLS_RSA_PUBLIC )
1307 ? mbedtls_rsa_public( ctx, output, output )
1308 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001309}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001310#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001311
Paul Bakker5121ce52009-01-03 21:22:43 +00001312/*
1313 * Add the message padding, then do an RSA operation
1314 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001315int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001316 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker21eb2802010-08-16 11:10:02 +00001317 void *p_rng,
Paul Bakker23986e52011-04-24 08:57:21 +00001318 int mode, size_t ilen,
Paul Bakkerff60ee62010-03-16 21:09:09 +00001319 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +00001320 unsigned char *output )
1321{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001322 RSA_VALIDATE_RET( ctx != NULL );
1323 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1324 mode == MBEDTLS_RSA_PUBLIC );
1325 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001326 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001327
Paul Bakker5121ce52009-01-03 21:22:43 +00001328 switch( ctx->padding )
1329 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001330#if defined(MBEDTLS_PKCS1_V15)
1331 case MBEDTLS_RSA_PKCS_V15:
1332 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001333 input, output );
Paul Bakker48377d92013-08-30 12:06:24 +02001334#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001336#if defined(MBEDTLS_PKCS1_V21)
1337 case MBEDTLS_RSA_PKCS_V21:
1338 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
Paul Bakkerb3869132013-02-28 17:21:01 +01001339 ilen, input, output );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001340#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001341
1342 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001343 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +00001344 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001345}
1346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001347#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +00001348/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001349 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
Paul Bakker5121ce52009-01-03 21:22:43 +00001350 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001351int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001352 int (*f_rng)(void *, unsigned char *, size_t),
1353 void *p_rng,
1354 int mode,
Paul Bakkera43231c2013-02-28 17:33:49 +01001355 const unsigned char *label, size_t label_len,
1356 size_t *olen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001357 const unsigned char *input,
1358 unsigned char *output,
1359 size_t output_max_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00001360{
Janos Follath24eed8d2019-11-22 13:21:35 +00001361 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001362 size_t ilen, i, pad_len;
1363 unsigned char *p, bad, pad_done;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
1365 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
Paul Bakker23986e52011-04-24 08:57:21 +00001366 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001367 const mbedtls_md_info_t *md_info;
1368 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001369
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001370 RSA_VALIDATE_RET( ctx != NULL );
1371 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1372 mode == MBEDTLS_RSA_PUBLIC );
1373 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1374 RSA_VALIDATE_RET( label_len == 0 || label != NULL );
1375 RSA_VALIDATE_RET( input != NULL );
1376 RSA_VALIDATE_RET( olen != NULL );
1377
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001378 /*
1379 * Parameters sanity checks
1380 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001381 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1382 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00001383
1384 ilen = ctx->len;
1385
Paul Bakker27fdf462011-06-09 13:55:13 +00001386 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001387 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00001388
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001389 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001390 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001391 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001392
Janos Follathc17cda12016-02-11 11:08:18 +00001393 hlen = mbedtls_md_get_size( md_info );
1394
1395 // checking for integer underflow
1396 if( 2 * hlen + 2 > ilen )
1397 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1398
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001399 /*
1400 * RSA operation
1401 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001402 ret = ( mode == MBEDTLS_RSA_PUBLIC )
1403 ? mbedtls_rsa_public( ctx, input, buf )
1404 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00001405
1406 if( ret != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001407 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00001408
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001409 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001410 * Unmask data and generate lHash
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001411 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001412 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001413 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
1414 {
1415 mbedtls_md_free( &md_ctx );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001416 goto cleanup;
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001417 }
1418
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001419 /* seed: Apply seedMask to maskedSeed */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001420 if( ( ret = mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
1421 &md_ctx ) ) != 0 ||
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001422 /* DB: Apply dbMask to maskedDB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001423 ( ret = mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
1424 &md_ctx ) ) != 0 )
1425 {
1426 mbedtls_md_free( &md_ctx );
1427 goto cleanup;
1428 }
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001431
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001432 /* Generate lHash */
1433 if( ( ret = mbedtls_md( md_info, label, label_len, lhash ) ) != 0 )
1434 goto cleanup;
1435
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001436 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001437 * Check contents, in "constant-time"
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001438 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001439 p = buf;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001440 bad = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001441
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001442 bad |= *p++; /* First byte must be 0 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001443
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001444 p += hlen; /* Skip seed */
Paul Bakkerb3869132013-02-28 17:21:01 +01001445
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001446 /* Check lHash */
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001447 for( i = 0; i < hlen; i++ )
1448 bad |= lhash[i] ^ *p++;
Paul Bakkerb3869132013-02-28 17:21:01 +01001449
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001450 /* Get zero-padding len, but always read till end of buffer
1451 * (minus one, for the 01 byte) */
1452 pad_len = 0;
1453 pad_done = 0;
1454 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
1455 {
1456 pad_done |= p[i];
Pascal Junodb99183d2015-03-11 16:49:45 +01001457 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001458 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001459
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001460 p += pad_len;
1461 bad |= *p++ ^ 0x01;
Paul Bakkerb3869132013-02-28 17:21:01 +01001462
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001463 /*
1464 * The only information "leaked" is whether the padding was correct or not
1465 * (eg, no data is copied if it was not correct). This meets the
1466 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
1467 * the different error conditions.
1468 */
1469 if( bad != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001470 {
1471 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
1472 goto cleanup;
1473 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001474
Paul Bakker66d5d072014-06-17 16:39:18 +02001475 if( ilen - ( p - buf ) > output_max_len )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001476 {
1477 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
1478 goto cleanup;
1479 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001480
1481 *olen = ilen - (p - buf);
Gilles Peskine004f87b2018-07-06 15:47:54 +02001482 if( *olen != 0 )
1483 memcpy( output, p, *olen );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001484 ret = 0;
Paul Bakkerb3869132013-02-28 17:21:01 +01001485
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001486cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001487 mbedtls_platform_zeroize( buf, sizeof( buf ) );
1488 mbedtls_platform_zeroize( lhash, sizeof( lhash ) );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001489
1490 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001491}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494#if defined(MBEDTLS_PKCS1_V15)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001495/** Turn zero-or-nonzero into zero-or-all-bits-one, without branches.
1496 *
1497 * \param value The value to analyze.
1498 * \return Zero if \p value is zero, otherwise all-bits-one.
1499 */
1500static unsigned all_or_nothing_int( unsigned value )
1501{
1502 /* MSVC has a warning about unary minus on unsigned, but this is
1503 * well-defined and precisely what we want to do here */
1504#if defined(_MSC_VER)
1505#pragma warning( push )
1506#pragma warning( disable : 4146 )
1507#endif
1508 return( - ( ( value | - value ) >> ( sizeof( value ) * 8 - 1 ) ) );
1509#if defined(_MSC_VER)
1510#pragma warning( pop )
1511#endif
1512}
1513
1514/** Check whether a size is out of bounds, without branches.
1515 *
1516 * This is equivalent to `size > max`, but is likely to be compiled to
1517 * to code using bitwise operation rather than a branch.
1518 *
1519 * \param size Size to check.
1520 * \param max Maximum desired value for \p size.
1521 * \return \c 0 if `size <= max`.
1522 * \return \c 1 if `size > max`.
1523 */
1524static unsigned size_greater_than( size_t size, size_t max )
1525{
1526 /* Return the sign bit (1 for negative) of (max - size). */
1527 return( ( max - size ) >> ( sizeof( size_t ) * 8 - 1 ) );
1528}
1529
1530/** Choose between two integer values, without branches.
1531 *
1532 * This is equivalent to `cond ? if1 : if0`, but is likely to be compiled
1533 * to code using bitwise operation rather than a branch.
1534 *
1535 * \param cond Condition to test.
1536 * \param if1 Value to use if \p cond is nonzero.
1537 * \param if0 Value to use if \p cond is zero.
1538 * \return \c if1 if \p cond is nonzero, otherwise \c if0.
1539 */
1540static unsigned if_int( unsigned cond, unsigned if1, unsigned if0 )
1541{
1542 unsigned mask = all_or_nothing_int( cond );
1543 return( ( mask & if1 ) | (~mask & if0 ) );
1544}
1545
1546/** Shift some data towards the left inside a buffer without leaking
1547 * the length of the data through side channels.
1548 *
1549 * `mem_move_to_left(start, total, offset)` is functionally equivalent to
1550 * ```
1551 * memmove(start, start + offset, total - offset);
1552 * memset(start + offset, 0, total - offset);
1553 * ```
1554 * but it strives to use a memory access pattern (and thus total timing)
1555 * that does not depend on \p offset. This timing independence comes at
1556 * the expense of performance.
1557 *
1558 * \param start Pointer to the start of the buffer.
1559 * \param total Total size of the buffer.
1560 * \param offset Offset from which to copy \p total - \p offset bytes.
1561 */
1562static void mem_move_to_left( void *start,
1563 size_t total,
1564 size_t offset )
1565{
1566 volatile unsigned char *buf = start;
1567 size_t i, n;
1568 if( total == 0 )
1569 return;
1570 for( i = 0; i < total; i++ )
1571 {
1572 unsigned no_op = size_greater_than( total - offset, i );
1573 /* The first `total - offset` passes are a no-op. The last
1574 * `offset` passes shift the data one byte to the left and
1575 * zero out the last byte. */
1576 for( n = 0; n < total - 1; n++ )
1577 {
1578 unsigned char current = buf[n];
1579 unsigned char next = buf[n+1];
1580 buf[n] = if_int( no_op, current, next );
1581 }
1582 buf[total-1] = if_int( no_op, buf[total-1], 0 );
1583 }
1584}
1585
Paul Bakkerb3869132013-02-28 17:21:01 +01001586/*
1587 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
1588 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001589int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001590 int (*f_rng)(void *, unsigned char *, size_t),
1591 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001592 int mode, size_t *olen,
1593 const unsigned char *input,
1594 unsigned char *output,
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001595 size_t output_max_len )
Paul Bakkerb3869132013-02-28 17:21:01 +01001596{
Janos Follath24eed8d2019-11-22 13:21:35 +00001597 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001598 size_t ilen, i, plaintext_max_size;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001599 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001600 /* The following variables take sensitive values: their value must
1601 * not leak into the observable behavior of the function other than
1602 * the designated outputs (output, olen, return value). Otherwise
1603 * this would open the execution of the function to
1604 * side-channel-based variants of the Bleichenbacher padding oracle
1605 * attack. Potential side channels include overall timing, memory
1606 * access patterns (especially visible to an adversary who has access
1607 * to a shared memory cache), and branches (especially visible to
1608 * an adversary who has access to a shared code cache or to a shared
1609 * branch predictor). */
1610 size_t pad_count = 0;
1611 unsigned bad = 0;
1612 unsigned char pad_done = 0;
1613 size_t plaintext_size = 0;
1614 unsigned output_too_large;
1615
1616 RSA_VALIDATE_RET( ctx != NULL );
1617 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1618 mode == MBEDTLS_RSA_PUBLIC );
1619 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1620 RSA_VALIDATE_RET( input != NULL );
1621 RSA_VALIDATE_RET( olen != NULL );
1622
1623 ilen = ctx->len;
1624 plaintext_max_size = ( output_max_len > ilen - 11 ?
1625 ilen - 11 :
1626 output_max_len );
Paul Bakkerb3869132013-02-28 17:21:01 +01001627
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001628 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
1629 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001630
Paul Bakkerb3869132013-02-28 17:21:01 +01001631 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001632 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001634 ret = ( mode == MBEDTLS_RSA_PUBLIC )
1635 ? mbedtls_rsa_public( ctx, input, buf )
1636 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakkerb3869132013-02-28 17:21:01 +01001637
1638 if( ret != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001639 goto cleanup;
Paul Bakkerb3869132013-02-28 17:21:01 +01001640
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001641 /* Check and get padding length in constant time and constant
1642 * memory trace. The first byte must be 0. */
1643 bad |= buf[0];
Paul Bakkerb3869132013-02-28 17:21:01 +01001644
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001645 if( mode == MBEDTLS_RSA_PRIVATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001646 {
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001647 /* Decode EME-PKCS1-v1_5 padding: 0x00 || 0x02 || PS || 0x00
1648 * where PS must be at least 8 nonzero bytes. */
1649 bad |= buf[1] ^ MBEDTLS_RSA_CRYPT;
Paul Bakker5121ce52009-01-03 21:22:43 +00001650
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001651 /* Read the whole buffer. Set pad_done to nonzero if we find
1652 * the 0x00 byte and remember the padding length in pad_count. */
1653 for( i = 2; i < ilen; i++ )
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +01001654 {
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001655 pad_done |= ((buf[i] | (unsigned char)-buf[i]) >> 7) ^ 1;
Pascal Junodb99183d2015-03-11 16:49:45 +01001656 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +01001657 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001658 }
1659 else
1660 {
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001661 /* Decode EMSA-PKCS1-v1_5 padding: 0x00 || 0x01 || PS || 0x00
1662 * where PS must be at least 8 bytes with the value 0xFF. */
1663 bad |= buf[1] ^ MBEDTLS_RSA_SIGN;
Paul Bakkerb3869132013-02-28 17:21:01 +01001664
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001665 /* Read the whole buffer. Set pad_done to nonzero if we find
1666 * the 0x00 byte and remember the padding length in pad_count.
1667 * If there's a non-0xff byte in the padding, the padding is bad. */
1668 for( i = 2; i < ilen; i++ )
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +01001669 {
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001670 pad_done |= if_int( buf[i], 0, 1 );
1671 pad_count += if_int( pad_done, 0, 1 );
1672 bad |= if_int( pad_done, 0, buf[i] ^ 0xFF );
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +01001673 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001674 }
1675
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001676 /* If pad_done is still zero, there's no data, only unfinished padding. */
1677 bad |= if_int( pad_done, 0, 1 );
Janos Follathb6eb1ca2016-02-08 13:59:25 +00001678
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001679 /* There must be at least 8 bytes of padding. */
1680 bad |= size_greater_than( 8, pad_count );
Paul Bakker8804f692013-02-28 18:06:26 +01001681
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001682 /* If the padding is valid, set plaintext_size to the number of
1683 * remaining bytes after stripping the padding. If the padding
1684 * is invalid, avoid leaking this fact through the size of the
1685 * output: use the maximum message size that fits in the output
1686 * buffer. Do it without branches to avoid leaking the padding
1687 * validity through timing. RSA keys are small enough that all the
1688 * size_t values involved fit in unsigned int. */
1689 plaintext_size = if_int( bad,
1690 (unsigned) plaintext_max_size,
1691 (unsigned) ( ilen - pad_count - 3 ) );
Paul Bakker060c5682009-01-12 21:48:39 +00001692
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001693 /* Set output_too_large to 0 if the plaintext fits in the output
1694 * buffer and to 1 otherwise. */
1695 output_too_large = size_greater_than( plaintext_size,
1696 plaintext_max_size );
1697
1698 /* Set ret without branches to avoid timing attacks. Return:
1699 * - INVALID_PADDING if the padding is bad (bad != 0).
1700 * - OUTPUT_TOO_LARGE if the padding is good but the decrypted
1701 * plaintext does not fit in the output buffer.
1702 * - 0 if the padding is correct. */
1703 ret = - (int) if_int( bad, - MBEDTLS_ERR_RSA_INVALID_PADDING,
1704 if_int( output_too_large, - MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE,
1705 0 ) );
1706
1707 /* If the padding is bad or the plaintext is too large, zero the
1708 * data that we're about to copy to the output buffer.
1709 * We need to copy the same amount of data
1710 * from the same buffer whether the padding is good or not to
1711 * avoid leaking the padding validity through overall timing or
1712 * through memory or cache access patterns. */
1713 bad = all_or_nothing_int( bad | output_too_large );
1714 for( i = 11; i < ilen; i++ )
1715 buf[i] &= ~bad;
1716
1717 /* If the plaintext is too large, truncate it to the buffer size.
1718 * Copy anyway to avoid revealing the length through timing, because
1719 * revealing the length is as bad as revealing the padding validity
1720 * for a Bleichenbacher attack. */
1721 plaintext_size = if_int( output_too_large,
1722 (unsigned) plaintext_max_size,
1723 (unsigned) plaintext_size );
1724
1725 /* Move the plaintext to the leftmost position where it can start in
1726 * the working buffer, i.e. make it start plaintext_max_size from
1727 * the end of the buffer. Do this with a memory access trace that
1728 * does not depend on the plaintext size. After this move, the
1729 * starting location of the plaintext is no longer sensitive
1730 * information. */
1731 mem_move_to_left( buf + ilen - plaintext_max_size,
1732 plaintext_max_size,
1733 plaintext_max_size - plaintext_size );
1734
Jaeden Amero6f7703d2019-02-06 10:44:56 +00001735 /* Finally copy the decrypted plaintext plus trailing zeros into the output
1736 * buffer. If output_max_len is 0, then output may be an invalid pointer
1737 * and the result of memcpy() would be undefined; prevent undefined
1738 * behavior making sure to depend only on output_max_len (the size of the
1739 * user-provided output buffer), which is independent from plaintext
1740 * length, validity of padding, success of the decryption, and other
1741 * secrets. */
1742 if( output_max_len != 0 )
1743 memcpy( output, buf + ilen - plaintext_max_size, plaintext_max_size );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001744
1745 /* Report the amount of data we copied to the output buffer. In case
1746 * of errors (bad padding or output too large), the value of *olen
1747 * when this function returns is not specified. Making it equivalent
1748 * to the good case limits the risks of leaking the padding validity. */
1749 *olen = plaintext_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001750
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001751cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001752 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001753
1754 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001755}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001756#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001757
1758/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001759 * Do an RSA operation, then remove the message padding
1760 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001762 int (*f_rng)(void *, unsigned char *, size_t),
1763 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001764 int mode, size_t *olen,
1765 const unsigned char *input,
1766 unsigned char *output,
1767 size_t output_max_len)
1768{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001769 RSA_VALIDATE_RET( ctx != NULL );
1770 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1771 mode == MBEDTLS_RSA_PUBLIC );
1772 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1773 RSA_VALIDATE_RET( input != NULL );
1774 RSA_VALIDATE_RET( olen != NULL );
1775
Paul Bakkerb3869132013-02-28 17:21:01 +01001776 switch( ctx->padding )
1777 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001778#if defined(MBEDTLS_PKCS1_V15)
1779 case MBEDTLS_RSA_PKCS_V15:
1780 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
Paul Bakker548957d2013-08-30 10:30:02 +02001781 input, output, output_max_len );
Paul Bakker48377d92013-08-30 12:06:24 +02001782#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01001783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001784#if defined(MBEDTLS_PKCS1_V21)
1785 case MBEDTLS_RSA_PKCS_V21:
1786 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
Paul Bakker548957d2013-08-30 10:30:02 +02001787 olen, input, output,
1788 output_max_len );
Paul Bakkerb3869132013-02-28 17:21:01 +01001789#endif
1790
1791 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001792 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001793 }
1794}
1795
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001796#if defined(MBEDTLS_PKCS1_V21)
Paul Bakkerb3869132013-02-28 17:21:01 +01001797/*
1798 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
1799 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001800int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001801 int (*f_rng)(void *, unsigned char *, size_t),
1802 void *p_rng,
1803 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001804 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001805 unsigned int hashlen,
1806 const unsigned char *hash,
1807 unsigned char *sig )
1808{
1809 size_t olen;
1810 unsigned char *p = sig;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001811 unsigned char salt[MBEDTLS_MD_MAX_SIZE];
Jaeden Amero3725bb22018-09-07 19:12:36 +01001812 size_t slen, min_slen, hlen, offset = 0;
Janos Follath24eed8d2019-11-22 13:21:35 +00001813 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001814 size_t msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815 const mbedtls_md_info_t *md_info;
1816 mbedtls_md_context_t md_ctx;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001817 RSA_VALIDATE_RET( ctx != NULL );
1818 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
1819 mode == MBEDTLS_RSA_PUBLIC );
1820 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
1821 hashlen == 0 ) ||
1822 hash != NULL );
1823 RSA_VALIDATE_RET( sig != NULL );
Paul Bakkerb3869132013-02-28 17:21:01 +01001824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001825 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1826 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001827
1828 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001829 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001830
1831 olen = ctx->len;
1832
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001833 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001834 {
Simon Butcher02037452016-03-01 21:19:12 +00001835 /* Gather length of hash to sign */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001836 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001837 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001840 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001841 }
1842
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001843 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001844 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001845 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001847 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001848
Jaeden Amero3725bb22018-09-07 19:12:36 +01001849 /* Calculate the largest possible salt length. Normally this is the hash
1850 * length, which is the maximum length the salt can have. If there is not
1851 * enough room, use the maximum salt length that fits. The constraint is
1852 * that the hash length plus the salt length plus 2 bytes must be at most
1853 * the key length. This complies with FIPS 186-4 §5.5 (e) and RFC 8017
1854 * (PKCS#1 v2.2) §9.1.1 step 3. */
1855 min_slen = hlen - 2;
1856 if( olen < hlen + min_slen + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001857 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Jaeden Amero3725bb22018-09-07 19:12:36 +01001858 else if( olen >= hlen + hlen + 2 )
1859 slen = hlen;
1860 else
1861 slen = olen - hlen - 2;
Paul Bakkerb3869132013-02-28 17:21:01 +01001862
1863 memset( sig, 0, olen );
1864
Simon Butcher02037452016-03-01 21:19:12 +00001865 /* Generate salt of length slen */
Paul Bakkerb3869132013-02-28 17:21:01 +01001866 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001868
Simon Butcher02037452016-03-01 21:19:12 +00001869 /* Note: EMSA-PSS encoding is over the length of N - 1 bits */
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001870 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Jaeden Amero3725bb22018-09-07 19:12:36 +01001871 p += olen - hlen - slen - 2;
Paul Bakkerb3869132013-02-28 17:21:01 +01001872 *p++ = 0x01;
1873 memcpy( p, salt, slen );
1874 p += slen;
1875
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001876 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001877 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001878 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001879
Simon Butcher02037452016-03-01 21:19:12 +00001880 /* Generate H = Hash( M' ) */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001881 if( ( ret = mbedtls_md_starts( &md_ctx ) ) != 0 )
1882 goto exit;
1883 if( ( ret = mbedtls_md_update( &md_ctx, p, 8 ) ) != 0 )
1884 goto exit;
1885 if( ( ret = mbedtls_md_update( &md_ctx, hash, hashlen ) ) != 0 )
1886 goto exit;
1887 if( ( ret = mbedtls_md_update( &md_ctx, salt, slen ) ) != 0 )
1888 goto exit;
1889 if( ( ret = mbedtls_md_finish( &md_ctx, p ) ) != 0 )
1890 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001891
Simon Butcher02037452016-03-01 21:19:12 +00001892 /* Compensate for boundary condition when applying mask */
Paul Bakkerb3869132013-02-28 17:21:01 +01001893 if( msb % 8 == 0 )
1894 offset = 1;
1895
Simon Butcher02037452016-03-01 21:19:12 +00001896 /* maskedDB: Apply dbMask to DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001897 if( ( ret = mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen,
1898 &md_ctx ) ) != 0 )
1899 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001900
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001901 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakkerb3869132013-02-28 17:21:01 +01001902 sig[0] &= 0xFF >> ( olen * 8 - msb );
1903
1904 p += hlen;
1905 *p++ = 0xBC;
1906
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001907 mbedtls_platform_zeroize( salt, sizeof( salt ) );
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001908
1909exit:
1910 mbedtls_md_free( &md_ctx );
1911
1912 if( ret != 0 )
1913 return( ret );
1914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001915 return( ( mode == MBEDTLS_RSA_PUBLIC )
1916 ? mbedtls_rsa_public( ctx, sig, sig )
1917 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001918}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001919#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001921#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001922/*
1923 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
1924 */
Hanno Beckerfdf38032017-09-06 12:35:55 +01001925
1926/* Construct a PKCS v1.5 encoding of a hashed message
1927 *
1928 * This is used both for signature generation and verification.
1929 *
1930 * Parameters:
1931 * - md_alg: Identifies the hash algorithm used to generate the given hash;
Hanno Beckere58d38c2017-09-27 17:09:00 +01001932 * MBEDTLS_MD_NONE if raw data is signed.
Hanno Beckerfdf38032017-09-06 12:35:55 +01001933 * - hashlen: Length of hash in case hashlen is MBEDTLS_MD_NONE.
Hanno Beckere58d38c2017-09-27 17:09:00 +01001934 * - hash: Buffer containing the hashed message or the raw data.
1935 * - dst_len: Length of the encoded message.
Hanno Beckerfdf38032017-09-06 12:35:55 +01001936 * - dst: Buffer to hold the encoded message.
1937 *
1938 * Assumptions:
1939 * - hash has size hashlen if md_alg == MBEDTLS_MD_NONE.
1940 * - hash has size corresponding to md_alg if md_alg != MBEDTLS_MD_NONE.
Hanno Beckere58d38c2017-09-27 17:09:00 +01001941 * - dst points to a buffer of size at least dst_len.
Hanno Beckerfdf38032017-09-06 12:35:55 +01001942 *
1943 */
1944static int rsa_rsassa_pkcs1_v15_encode( mbedtls_md_type_t md_alg,
1945 unsigned int hashlen,
1946 const unsigned char *hash,
Hanno Beckere58d38c2017-09-27 17:09:00 +01001947 size_t dst_len,
Hanno Beckerfdf38032017-09-06 12:35:55 +01001948 unsigned char *dst )
1949{
1950 size_t oid_size = 0;
Hanno Beckere58d38c2017-09-27 17:09:00 +01001951 size_t nb_pad = dst_len;
Hanno Beckerfdf38032017-09-06 12:35:55 +01001952 unsigned char *p = dst;
1953 const char *oid = NULL;
1954
1955 /* Are we signing hashed or raw data? */
1956 if( md_alg != MBEDTLS_MD_NONE )
1957 {
1958 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
1959 if( md_info == NULL )
1960 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1961
1962 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
1963 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1964
1965 hashlen = mbedtls_md_get_size( md_info );
1966
1967 /* Double-check that 8 + hashlen + oid_size can be used as a
1968 * 1-byte ASN.1 length encoding and that there's no overflow. */
1969 if( 8 + hashlen + oid_size >= 0x80 ||
1970 10 + hashlen < hashlen ||
1971 10 + hashlen + oid_size < 10 + hashlen )
1972 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1973
1974 /*
1975 * Static bounds check:
1976 * - Need 10 bytes for five tag-length pairs.
1977 * (Insist on 1-byte length encodings to protect against variants of
1978 * Bleichenbacher's forgery attack against lax PKCS#1v1.5 verification)
1979 * - Need hashlen bytes for hash
1980 * - Need oid_size bytes for hash alg OID.
1981 */
1982 if( nb_pad < 10 + hashlen + oid_size )
1983 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1984 nb_pad -= 10 + hashlen + oid_size;
1985 }
1986 else
1987 {
1988 if( nb_pad < hashlen )
1989 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1990
1991 nb_pad -= hashlen;
1992 }
1993
Hanno Becker2b2f8982017-09-27 17:10:03 +01001994 /* Need space for signature header and padding delimiter (3 bytes),
1995 * and 8 bytes for the minimal padding */
1996 if( nb_pad < 3 + 8 )
Hanno Beckerfdf38032017-09-06 12:35:55 +01001997 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1998 nb_pad -= 3;
1999
2000 /* Now nb_pad is the amount of memory to be filled
Hanno Becker2b2f8982017-09-27 17:10:03 +01002001 * with padding, and at least 8 bytes long. */
Hanno Beckerfdf38032017-09-06 12:35:55 +01002002
2003 /* Write signature header and padding */
2004 *p++ = 0;
2005 *p++ = MBEDTLS_RSA_SIGN;
2006 memset( p, 0xFF, nb_pad );
2007 p += nb_pad;
2008 *p++ = 0;
2009
2010 /* Are we signing raw data? */
2011 if( md_alg == MBEDTLS_MD_NONE )
2012 {
2013 memcpy( p, hash, hashlen );
2014 return( 0 );
2015 }
2016
2017 /* Signing hashed data, add corresponding ASN.1 structure
2018 *
2019 * DigestInfo ::= SEQUENCE {
2020 * digestAlgorithm DigestAlgorithmIdentifier,
2021 * digest Digest }
2022 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
2023 * Digest ::= OCTET STRING
2024 *
2025 * Schematic:
2026 * TAG-SEQ + LEN [ TAG-SEQ + LEN [ TAG-OID + LEN [ OID ]
2027 * TAG-NULL + LEN [ NULL ] ]
2028 * TAG-OCTET + LEN [ HASH ] ]
2029 */
2030 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Hanno Becker87ae1972018-01-15 15:27:56 +00002031 *p++ = (unsigned char)( 0x08 + oid_size + hashlen );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002032 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Hanno Becker87ae1972018-01-15 15:27:56 +00002033 *p++ = (unsigned char)( 0x04 + oid_size );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002034 *p++ = MBEDTLS_ASN1_OID;
Hanno Becker87ae1972018-01-15 15:27:56 +00002035 *p++ = (unsigned char) oid_size;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002036 memcpy( p, oid, oid_size );
2037 p += oid_size;
2038 *p++ = MBEDTLS_ASN1_NULL;
2039 *p++ = 0x00;
2040 *p++ = MBEDTLS_ASN1_OCTET_STRING;
Hanno Becker87ae1972018-01-15 15:27:56 +00002041 *p++ = (unsigned char) hashlen;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002042 memcpy( p, hash, hashlen );
2043 p += hashlen;
2044
2045 /* Just a sanity-check, should be automatic
2046 * after the initial bounds check. */
Hanno Beckere58d38c2017-09-27 17:09:00 +01002047 if( p != dst + dst_len )
Hanno Beckerfdf38032017-09-06 12:35:55 +01002048 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002049 mbedtls_platform_zeroize( dst, dst_len );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002050 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2051 }
2052
2053 return( 0 );
2054}
2055
Paul Bakkerb3869132013-02-28 17:21:01 +01002056/*
2057 * Do an RSA operation to sign the message digest
2058 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002059int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02002060 int (*f_rng)(void *, unsigned char *, size_t),
2061 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01002062 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002064 unsigned int hashlen,
2065 const unsigned char *hash,
2066 unsigned char *sig )
2067{
Janos Follath24eed8d2019-11-22 13:21:35 +00002068 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002069 unsigned char *sig_try = NULL, *verif = NULL;
Paul Bakkerb3869132013-02-28 17:21:01 +01002070
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002071 RSA_VALIDATE_RET( ctx != NULL );
2072 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2073 mode == MBEDTLS_RSA_PUBLIC );
2074 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2075 hashlen == 0 ) ||
2076 hash != NULL );
2077 RSA_VALIDATE_RET( sig != NULL );
2078
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002079 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
2080 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01002081
Hanno Beckerfdf38032017-09-06 12:35:55 +01002082 /*
2083 * Prepare PKCS1-v1.5 encoding (padding and hash identifier)
2084 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002085
Hanno Beckerfdf38032017-09-06 12:35:55 +01002086 if( ( ret = rsa_rsassa_pkcs1_v15_encode( md_alg, hashlen, hash,
2087 ctx->len, sig ) ) != 0 )
2088 return( ret );
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002089
2090 /*
Hanno Beckerfdf38032017-09-06 12:35:55 +01002091 * Call respective RSA primitive
2092 */
2093
2094 if( mode == MBEDTLS_RSA_PUBLIC )
2095 {
2096 /* Skip verification on a public key operation */
2097 return( mbedtls_rsa_public( ctx, sig, sig ) );
2098 }
2099
2100 /* Private key operation
2101 *
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002102 * In order to prevent Lenstra's attack, make the signature in a
2103 * temporary buffer and check it before returning it.
2104 */
Hanno Beckerfdf38032017-09-06 12:35:55 +01002105
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002106 sig_try = mbedtls_calloc( 1, ctx->len );
Simon Butcher1285ab52016-01-01 21:42:47 +00002107 if( sig_try == NULL )
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002108 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
2109
Hanno Beckerfdf38032017-09-06 12:35:55 +01002110 verif = mbedtls_calloc( 1, ctx->len );
Simon Butcher1285ab52016-01-01 21:42:47 +00002111 if( verif == NULL )
2112 {
2113 mbedtls_free( sig_try );
2114 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
2115 }
2116
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002117 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
2118 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
2119
Hanno Becker171a8f12017-09-06 12:32:16 +01002120 if( mbedtls_safer_memcmp( verif, sig, ctx->len ) != 0 )
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002121 {
2122 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
2123 goto cleanup;
2124 }
2125
2126 memcpy( sig, sig_try, ctx->len );
2127
2128cleanup:
2129 mbedtls_free( sig_try );
2130 mbedtls_free( verif );
2131
2132 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01002133}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002134#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002135
2136/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002137 * Do an RSA operation to sign the message digest
2138 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002139int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +00002140 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker9dcc3222011-03-08 14:16:06 +00002141 void *p_rng,
Paul Bakker5121ce52009-01-03 21:22:43 +00002142 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002143 mbedtls_md_type_t md_alg,
Paul Bakker23986e52011-04-24 08:57:21 +00002144 unsigned int hashlen,
Paul Bakkerff60ee62010-03-16 21:09:09 +00002145 const unsigned char *hash,
Paul Bakker5121ce52009-01-03 21:22:43 +00002146 unsigned char *sig )
2147{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002148 RSA_VALIDATE_RET( ctx != NULL );
2149 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2150 mode == MBEDTLS_RSA_PUBLIC );
2151 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2152 hashlen == 0 ) ||
2153 hash != NULL );
2154 RSA_VALIDATE_RET( sig != NULL );
2155
Paul Bakker5121ce52009-01-03 21:22:43 +00002156 switch( ctx->padding )
2157 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002158#if defined(MBEDTLS_PKCS1_V15)
2159 case MBEDTLS_RSA_PKCS_V15:
2160 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002161 hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02002162#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002163
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002164#if defined(MBEDTLS_PKCS1_V21)
2165 case MBEDTLS_RSA_PKCS_V21:
2166 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002167 hashlen, hash, sig );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002168#endif
2169
Paul Bakker5121ce52009-01-03 21:22:43 +00002170 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +00002172 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002173}
2174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +00002176/*
Paul Bakkerb3869132013-02-28 17:21:01 +01002177 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
Paul Bakker5121ce52009-01-03 21:22:43 +00002178 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002179int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002180 int (*f_rng)(void *, unsigned char *, size_t),
2181 void *p_rng,
2182 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002183 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002184 unsigned int hashlen,
2185 const unsigned char *hash,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002186 mbedtls_md_type_t mgf1_hash_id,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002187 int expected_salt_len,
2188 const unsigned char *sig )
Paul Bakker5121ce52009-01-03 21:22:43 +00002189{
Janos Follath24eed8d2019-11-22 13:21:35 +00002190 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01002191 size_t siglen;
2192 unsigned char *p;
Gilles Peskine6a54b022017-10-17 19:02:13 +02002193 unsigned char *hash_start;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002194 unsigned char result[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +00002195 unsigned char zeros[8];
Paul Bakker23986e52011-04-24 08:57:21 +00002196 unsigned int hlen;
Gilles Peskine6a54b022017-10-17 19:02:13 +02002197 size_t observed_salt_len, msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198 const mbedtls_md_info_t *md_info;
2199 mbedtls_md_context_t md_ctx;
Nicholas Wilson409401c2016-04-13 11:48:25 +01002200 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Paul Bakkerb3869132013-02-28 17:21:01 +01002201
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002202 RSA_VALIDATE_RET( ctx != NULL );
2203 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2204 mode == MBEDTLS_RSA_PUBLIC );
2205 RSA_VALIDATE_RET( sig != NULL );
2206 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2207 hashlen == 0 ) ||
2208 hash != NULL );
2209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002210 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
2211 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01002212
Paul Bakker5121ce52009-01-03 21:22:43 +00002213 siglen = ctx->len;
2214
Paul Bakker27fdf462011-06-09 13:55:13 +00002215 if( siglen < 16 || siglen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002216 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00002217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218 ret = ( mode == MBEDTLS_RSA_PUBLIC )
2219 ? mbedtls_rsa_public( ctx, sig, buf )
2220 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00002221
2222 if( ret != 0 )
2223 return( ret );
2224
2225 p = buf;
2226
Paul Bakkerb3869132013-02-28 17:21:01 +01002227 if( buf[siglen - 1] != 0xBC )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002228 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01002229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002230 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002231 {
Simon Butcher02037452016-03-01 21:19:12 +00002232 /* Gather length of hash to sign */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002233 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002234 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002235 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002236
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002237 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01002238 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002239
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002240 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01002241 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002242 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002244 hlen = mbedtls_md_get_size( md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002245
Paul Bakkerb3869132013-02-28 17:21:01 +01002246 memset( zeros, 0, 8 );
Paul Bakker53019ae2011-03-25 13:58:48 +00002247
Simon Butcher02037452016-03-01 21:19:12 +00002248 /*
2249 * Note: EMSA-PSS verification is over the length of N - 1 bits
2250 */
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02002251 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002252
Gilles Peskineb00b0da2017-10-19 15:23:49 +02002253 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
2254 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2255
Simon Butcher02037452016-03-01 21:19:12 +00002256 /* Compensate for boundary condition when applying mask */
Paul Bakkerb3869132013-02-28 17:21:01 +01002257 if( msb % 8 == 0 )
2258 {
2259 p++;
2260 siglen -= 1;
2261 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002262
Gilles Peskine139108a2017-10-18 19:03:42 +02002263 if( siglen < hlen + 2 )
2264 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2265 hash_start = p + siglen - hlen - 1;
2266
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002267 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07002268 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002269 goto exit;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002270
Jaeden Amero66954e12018-01-25 16:05:54 +00002271 ret = mgf_mask( p, siglen - hlen - 1, hash_start, hlen, &md_ctx );
2272 if( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002273 goto exit;
Paul Bakker02303e82013-01-03 11:08:31 +01002274
Paul Bakkerb3869132013-02-28 17:21:01 +01002275 buf[0] &= 0xFF >> ( siglen * 8 - msb );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002276
Gilles Peskine6a54b022017-10-17 19:02:13 +02002277 while( p < hash_start - 1 && *p == 0 )
Paul Bakkerb3869132013-02-28 17:21:01 +01002278 p++;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002279
Gilles Peskine91048a32017-10-19 17:46:14 +02002280 if( *p++ != 0x01 )
Paul Bakkerb3869132013-02-28 17:21:01 +01002281 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002282 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
2283 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01002284 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002285
Gilles Peskine6a54b022017-10-17 19:02:13 +02002286 observed_salt_len = hash_start - p;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002288 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
Gilles Peskine6a54b022017-10-17 19:02:13 +02002289 observed_salt_len != (size_t) expected_salt_len )
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002290 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002291 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
2292 goto exit;
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002293 }
2294
Simon Butcher02037452016-03-01 21:19:12 +00002295 /*
2296 * Generate H = Hash( M' )
2297 */
Jaeden Amero66954e12018-01-25 16:05:54 +00002298 ret = mbedtls_md_starts( &md_ctx );
2299 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002300 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002301 ret = mbedtls_md_update( &md_ctx, zeros, 8 );
2302 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002303 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002304 ret = mbedtls_md_update( &md_ctx, hash, hashlen );
2305 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002306 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002307 ret = mbedtls_md_update( &md_ctx, p, observed_salt_len );
2308 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002309 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002310 ret = mbedtls_md_finish( &md_ctx, result );
2311 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002312 goto exit;
Paul Bakker53019ae2011-03-25 13:58:48 +00002313
Jaeden Amero66954e12018-01-25 16:05:54 +00002314 if( memcmp( hash_start, result, hlen ) != 0 )
Andres Amaya Garciac5c7d762017-07-20 14:42:16 +01002315 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002316 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
Andres Amaya Garciac5c7d762017-07-20 14:42:16 +01002317 goto exit;
2318 }
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002319
2320exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002321 mbedtls_md_free( &md_ctx );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002322
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002323 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01002324}
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002325
2326/*
2327 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
2328 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002329int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002330 int (*f_rng)(void *, unsigned char *, size_t),
2331 void *p_rng,
2332 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002334 unsigned int hashlen,
2335 const unsigned char *hash,
2336 const unsigned char *sig )
2337{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002338 mbedtls_md_type_t mgf1_hash_id;
2339 RSA_VALIDATE_RET( ctx != NULL );
2340 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2341 mode == MBEDTLS_RSA_PUBLIC );
2342 RSA_VALIDATE_RET( sig != NULL );
2343 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2344 hashlen == 0 ) ||
2345 hash != NULL );
2346
2347 mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002348 ? (mbedtls_md_type_t) ctx->hash_id
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002349 : md_alg;
2350
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002351 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002352 md_alg, hashlen, hash,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002353 mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002354 sig ) );
2355
2356}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002357#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker40628ba2013-01-03 10:50:31 +01002358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002359#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01002360/*
2361 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
2362 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002363int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02002364 int (*f_rng)(void *, unsigned char *, size_t),
2365 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01002366 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002367 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002368 unsigned int hashlen,
2369 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02002370 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01002371{
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002372 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002373 size_t sig_len;
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002374 unsigned char *encoded = NULL, *encoded_expected = NULL;
Paul Bakkerb3869132013-02-28 17:21:01 +01002375
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002376 RSA_VALIDATE_RET( ctx != NULL );
2377 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2378 mode == MBEDTLS_RSA_PUBLIC );
2379 RSA_VALIDATE_RET( sig != NULL );
2380 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2381 hashlen == 0 ) ||
2382 hash != NULL );
2383
2384 sig_len = ctx->len;
2385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002386 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
2387 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01002388
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002389 /*
2390 * Prepare expected PKCS1 v1.5 encoding of hash.
2391 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002392
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002393 if( ( encoded = mbedtls_calloc( 1, sig_len ) ) == NULL ||
2394 ( encoded_expected = mbedtls_calloc( 1, sig_len ) ) == NULL )
2395 {
2396 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
2397 goto cleanup;
2398 }
2399
2400 if( ( ret = rsa_rsassa_pkcs1_v15_encode( md_alg, hashlen, hash, sig_len,
2401 encoded_expected ) ) != 0 )
2402 goto cleanup;
2403
2404 /*
2405 * Apply RSA primitive to get what should be PKCS1 encoded hash.
2406 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002408 ret = ( mode == MBEDTLS_RSA_PUBLIC )
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002409 ? mbedtls_rsa_public( ctx, sig, encoded )
2410 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, encoded );
Paul Bakkerb3869132013-02-28 17:21:01 +01002411 if( ret != 0 )
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002412 goto cleanup;
Paul Bakkerc70b9822013-04-07 22:00:46 +02002413
Simon Butcher02037452016-03-01 21:19:12 +00002414 /*
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002415 * Compare
Simon Butcher02037452016-03-01 21:19:12 +00002416 */
Paul Bakkerc70b9822013-04-07 22:00:46 +02002417
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002418 if( ( ret = mbedtls_safer_memcmp( encoded, encoded_expected,
2419 sig_len ) ) != 0 )
2420 {
2421 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
2422 goto cleanup;
2423 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002424
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002425cleanup:
Paul Bakkerc70b9822013-04-07 22:00:46 +02002426
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002427 if( encoded != NULL )
2428 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002429 mbedtls_platform_zeroize( encoded, sig_len );
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002430 mbedtls_free( encoded );
2431 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002432
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002433 if( encoded_expected != NULL )
2434 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002435 mbedtls_platform_zeroize( encoded_expected, sig_len );
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002436 mbedtls_free( encoded_expected );
2437 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002438
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002439 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002440}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002441#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002442
2443/*
Paul Bakkerb3869132013-02-28 17:21:01 +01002444 * Do an RSA operation and check the message digest
2445 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002446int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02002447 int (*f_rng)(void *, unsigned char *, size_t),
2448 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01002449 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002450 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002451 unsigned int hashlen,
2452 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02002453 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01002454{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002455 RSA_VALIDATE_RET( ctx != NULL );
2456 RSA_VALIDATE_RET( mode == MBEDTLS_RSA_PRIVATE ||
2457 mode == MBEDTLS_RSA_PUBLIC );
2458 RSA_VALIDATE_RET( sig != NULL );
2459 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2460 hashlen == 0 ) ||
2461 hash != NULL );
2462
Paul Bakkerb3869132013-02-28 17:21:01 +01002463 switch( ctx->padding )
2464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002465#if defined(MBEDTLS_PKCS1_V15)
2466 case MBEDTLS_RSA_PKCS_V15:
2467 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002468 hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02002469#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01002470
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002471#if defined(MBEDTLS_PKCS1_V21)
2472 case MBEDTLS_RSA_PKCS_V21:
2473 return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002474 hashlen, hash, sig );
2475#endif
2476
2477 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002478 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01002479 }
2480}
2481
2482/*
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002483 * Copy the components of an RSA key
2484 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002485int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002486{
Janos Follath24eed8d2019-11-22 13:21:35 +00002487 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002488 RSA_VALIDATE_RET( dst != NULL );
2489 RSA_VALIDATE_RET( src != NULL );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002490
2491 dst->ver = src->ver;
2492 dst->len = src->len;
2493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002494 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
2495 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002497 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
2498 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
2499 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
Hanno Becker33c30a02017-08-23 07:00:22 +01002500
2501#if !defined(MBEDTLS_RSA_NO_CRT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002502 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
2503 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
2504 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002505 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
2506 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
Hanno Becker33c30a02017-08-23 07:00:22 +01002507#endif
2508
2509 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002511 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
2512 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +02002513
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002514 dst->padding = src->padding;
Manuel Pégourié-Gonnardfdddac92014-03-25 15:58:35 +01002515 dst->hash_id = src->hash_id;
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002516
2517cleanup:
2518 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002519 mbedtls_rsa_free( dst );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002520
2521 return( ret );
2522}
2523
2524/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002525 * Free the components of an RSA key
2526 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002527void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +00002528{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002529 if( ctx == NULL )
2530 return;
2531
2532 mbedtls_mpi_free( &ctx->Vi );
2533 mbedtls_mpi_free( &ctx->Vf );
2534 mbedtls_mpi_free( &ctx->RN );
2535 mbedtls_mpi_free( &ctx->D );
2536 mbedtls_mpi_free( &ctx->Q );
2537 mbedtls_mpi_free( &ctx->P );
2538 mbedtls_mpi_free( &ctx->E );
2539 mbedtls_mpi_free( &ctx->N );
Paul Bakkerc9965dc2013-09-29 14:58:17 +02002540
Hanno Becker33c30a02017-08-23 07:00:22 +01002541#if !defined(MBEDTLS_RSA_NO_CRT)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002542 mbedtls_mpi_free( &ctx->RQ );
2543 mbedtls_mpi_free( &ctx->RP );
2544 mbedtls_mpi_free( &ctx->QP );
2545 mbedtls_mpi_free( &ctx->DQ );
Hanno Becker33c30a02017-08-23 07:00:22 +01002546 mbedtls_mpi_free( &ctx->DP );
2547#endif /* MBEDTLS_RSA_NO_CRT */
2548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002549#if defined(MBEDTLS_THREADING_C)
2550 mbedtls_mutex_free( &ctx->mutex );
Paul Bakkerc9965dc2013-09-29 14:58:17 +02002551#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002552}
2553
Hanno Beckerab377312017-08-23 16:24:51 +01002554#endif /* !MBEDTLS_RSA_ALT */
2555
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002556#if defined(MBEDTLS_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +00002557
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00002558#include "mbedtls/sha1.h"
Paul Bakker5121ce52009-01-03 21:22:43 +00002559
2560/*
2561 * Example RSA-1024 keypair, for test purposes
2562 */
2563#define KEY_LEN 128
2564
2565#define RSA_N "9292758453063D803DD603D5E777D788" \
2566 "8ED1D5BF35786190FA2F23EBC0848AEA" \
2567 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
2568 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
2569 "93A89813FBF3C4F8066D2D800F7C38A8" \
2570 "1AE31942917403FF4946B0A83D3D3E05" \
2571 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
2572 "5E94BB77B07507233A0BC7BAC8F90F79"
2573
2574#define RSA_E "10001"
2575
2576#define RSA_D "24BF6185468786FDD303083D25E64EFC" \
2577 "66CA472BC44D253102F8B4A9D3BFA750" \
2578 "91386C0077937FE33FA3252D28855837" \
2579 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
2580 "DF79C5CE07EE72C7F123142198164234" \
2581 "CABB724CF78B8173B9F880FC86322407" \
2582 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
2583 "071513A1E85B5DFA031F21ECAE91A34D"
2584
2585#define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
2586 "2C01CAD19EA484A87EA4377637E75500" \
2587 "FCB2005C5C7DD6EC4AC023CDA285D796" \
2588 "C3D9E75E1EFC42488BB4F1D13AC30A57"
2589
2590#define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
2591 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
2592 "910E4168387E3C30AA1E00C339A79508" \
2593 "8452DD96A9A5EA5D9DCA68DA636032AF"
2594
Paul Bakker5121ce52009-01-03 21:22:43 +00002595#define PT_LEN 24
2596#define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
2597 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
2598
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002599#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkera3d195c2011-11-27 21:07:34 +00002600static int myrand( void *rng_state, unsigned char *output, size_t len )
Paul Bakker545570e2010-07-18 09:00:25 +00002601{
Paul Bakkerf96f7b62014-04-30 16:02:38 +02002602#if !defined(__OpenBSD__)
Paul Bakkera3d195c2011-11-27 21:07:34 +00002603 size_t i;
2604
Paul Bakker545570e2010-07-18 09:00:25 +00002605 if( rng_state != NULL )
2606 rng_state = NULL;
2607
Paul Bakkera3d195c2011-11-27 21:07:34 +00002608 for( i = 0; i < len; ++i )
2609 output[i] = rand();
Paul Bakkerf96f7b62014-04-30 16:02:38 +02002610#else
2611 if( rng_state != NULL )
2612 rng_state = NULL;
2613
2614 arc4random_buf( output, len );
2615#endif /* !OpenBSD */
Paul Bakker48377d92013-08-30 12:06:24 +02002616
Paul Bakkera3d195c2011-11-27 21:07:34 +00002617 return( 0 );
Paul Bakker545570e2010-07-18 09:00:25 +00002618}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002619#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker545570e2010-07-18 09:00:25 +00002620
Paul Bakker5121ce52009-01-03 21:22:43 +00002621/*
2622 * Checkup routine
2623 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002624int mbedtls_rsa_self_test( int verbose )
Paul Bakker5121ce52009-01-03 21:22:43 +00002625{
Paul Bakker3d8fb632014-04-17 12:42:41 +02002626 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002627#if defined(MBEDTLS_PKCS1_V15)
Paul Bakker23986e52011-04-24 08:57:21 +00002628 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002629 mbedtls_rsa_context rsa;
Paul Bakker5121ce52009-01-03 21:22:43 +00002630 unsigned char rsa_plaintext[PT_LEN];
2631 unsigned char rsa_decrypted[PT_LEN];
2632 unsigned char rsa_ciphertext[KEY_LEN];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002633#if defined(MBEDTLS_SHA1_C)
Paul Bakker5690efc2011-05-26 13:16:06 +00002634 unsigned char sha1sum[20];
2635#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002636
Hanno Becker3a701162017-08-22 13:52:43 +01002637 mbedtls_mpi K;
2638
2639 mbedtls_mpi_init( &K );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002640 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002641
Hanno Becker3a701162017-08-22 13:52:43 +01002642 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_N ) );
2643 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, &K, NULL, NULL, NULL, NULL ) );
2644 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_P ) );
2645 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, &K, NULL, NULL, NULL ) );
2646 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_Q ) );
2647 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, &K, NULL, NULL ) );
2648 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_D ) );
2649 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, NULL, &K, NULL ) );
2650 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_E ) );
2651 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, NULL, NULL, &K ) );
2652
Hanno Becker7f25f852017-10-10 16:56:22 +01002653 MBEDTLS_MPI_CHK( mbedtls_rsa_complete( &rsa ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002654
2655 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002656 mbedtls_printf( " RSA key validation: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002658 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
2659 mbedtls_rsa_check_privkey( &rsa ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002660 {
2661 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002662 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002663
Hanno Becker5bc87292017-05-03 15:09:31 +01002664 ret = 1;
2665 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002666 }
2667
2668 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002669 mbedtls_printf( "passed\n PKCS#1 encryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002670
2671 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
2672
Hanno Becker98838b02017-10-02 13:16:10 +01002673 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC,
2674 PT_LEN, rsa_plaintext,
2675 rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002676 {
2677 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002679
Hanno Becker5bc87292017-05-03 15:09:31 +01002680 ret = 1;
2681 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002682 }
2683
2684 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 mbedtls_printf( "passed\n PKCS#1 decryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002686
Hanno Becker98838b02017-10-02 13:16:10 +01002687 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE,
2688 &len, rsa_ciphertext, rsa_decrypted,
2689 sizeof(rsa_decrypted) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002690 {
2691 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002692 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002693
Hanno Becker5bc87292017-05-03 15:09:31 +01002694 ret = 1;
2695 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002696 }
2697
2698 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
2699 {
2700 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002701 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002702
Hanno Becker5bc87292017-05-03 15:09:31 +01002703 ret = 1;
2704 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002705 }
2706
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002707 if( verbose != 0 )
2708 mbedtls_printf( "passed\n" );
2709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002710#if defined(MBEDTLS_SHA1_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00002711 if( verbose != 0 )
Brian Murray930a3702016-05-18 14:38:02 -07002712 mbedtls_printf( " PKCS#1 data sign : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002713
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01002714 if( mbedtls_sha1_ret( rsa_plaintext, PT_LEN, sha1sum ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002715 {
2716 if( verbose != 0 )
2717 mbedtls_printf( "failed\n" );
2718
2719 return( 1 );
2720 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002721
Hanno Becker98838b02017-10-02 13:16:10 +01002722 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL,
2723 MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
2724 sha1sum, rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002725 {
2726 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002727 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002728
Hanno Becker5bc87292017-05-03 15:09:31 +01002729 ret = 1;
2730 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002731 }
2732
2733 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002734 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002735
Hanno Becker98838b02017-10-02 13:16:10 +01002736 if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL,
2737 MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
2738 sha1sum, rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002739 {
2740 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002741 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002742
Hanno Becker5bc87292017-05-03 15:09:31 +01002743 ret = 1;
2744 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002745 }
2746
2747 if( verbose != 0 )
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002748 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002749#endif /* MBEDTLS_SHA1_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002750
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002751 if( verbose != 0 )
2752 mbedtls_printf( "\n" );
2753
Paul Bakker3d8fb632014-04-17 12:42:41 +02002754cleanup:
Hanno Becker3a701162017-08-22 13:52:43 +01002755 mbedtls_mpi_free( &K );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002756 mbedtls_rsa_free( &rsa );
2757#else /* MBEDTLS_PKCS1_V15 */
Paul Bakker3e41fe82013-09-15 17:42:50 +02002758 ((void) verbose);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002759#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker3d8fb632014-04-17 12:42:41 +02002760 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002761}
2762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002763#endif /* MBEDTLS_SELF_TEST */
Paul Bakker5121ce52009-01-03 21:22:43 +00002764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002765#endif /* MBEDTLS_RSA_C */