A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

245 lines
6.5 KiB

  1. /*
  2. * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include "internal/constant_time_locl.h"
  10. #include <stdio.h>
  11. #include "internal/cryptlib.h"
  12. #include <openssl/bn.h>
  13. #include <openssl/rsa.h>
  14. #include <openssl/rand.h>
  15. int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
  16. const unsigned char *from, int flen)
  17. {
  18. int j;
  19. unsigned char *p;
  20. if (flen > (tlen - RSA_PKCS1_PADDING_SIZE)) {
  21. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,
  22. RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
  23. return (0);
  24. }
  25. p = (unsigned char *)to;
  26. *(p++) = 0;
  27. *(p++) = 1; /* Private Key BT (Block Type) */
  28. /* pad out with 0xff data */
  29. j = tlen - 3 - flen;
  30. memset(p, 0xff, j);
  31. p += j;
  32. *(p++) = '\0';
  33. memcpy(p, from, (unsigned int)flen);
  34. return (1);
  35. }
  36. int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
  37. const unsigned char *from, int flen,
  38. int num)
  39. {
  40. int i, j;
  41. const unsigned char *p;
  42. p = from;
  43. /*
  44. * The format is
  45. * 00 || 01 || PS || 00 || D
  46. * PS - padding string, at least 8 bytes of FF
  47. * D - data.
  48. */
  49. if (num < 11)
  50. return -1;
  51. /* Accept inputs with and without the leading 0-byte. */
  52. if (num == flen) {
  53. if ((*p++) != 0x00) {
  54. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  55. RSA_R_INVALID_PADDING);
  56. return -1;
  57. }
  58. flen--;
  59. }
  60. if ((num != (flen + 1)) || (*(p++) != 0x01)) {
  61. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  62. RSA_R_BLOCK_TYPE_IS_NOT_01);
  63. return (-1);
  64. }
  65. /* scan over padding data */
  66. j = flen - 1; /* one for type. */
  67. for (i = 0; i < j; i++) {
  68. if (*p != 0xff) { /* should decrypt to 0xff */
  69. if (*p == 0) {
  70. p++;
  71. break;
  72. } else {
  73. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  74. RSA_R_BAD_FIXED_HEADER_DECRYPT);
  75. return (-1);
  76. }
  77. }
  78. p++;
  79. }
  80. if (i == j) {
  81. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  82. RSA_R_NULL_BEFORE_BLOCK_MISSING);
  83. return (-1);
  84. }
  85. if (i < 8) {
  86. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  87. RSA_R_BAD_PAD_BYTE_COUNT);
  88. return (-1);
  89. }
  90. i++; /* Skip over the '\0' */
  91. j -= i;
  92. if (j > tlen) {
  93. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1, RSA_R_DATA_TOO_LARGE);
  94. return (-1);
  95. }
  96. memcpy(to, p, (unsigned int)j);
  97. return (j);
  98. }
  99. int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
  100. const unsigned char *from, int flen)
  101. {
  102. int i, j;
  103. unsigned char *p;
  104. if (flen > (tlen - 11)) {
  105. RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2,
  106. RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
  107. return (0);
  108. }
  109. p = (unsigned char *)to;
  110. *(p++) = 0;
  111. *(p++) = 2; /* Public Key BT (Block Type) */
  112. /* pad out with non-zero random data */
  113. j = tlen - 3 - flen;
  114. if (RAND_bytes(p, j) <= 0)
  115. return (0);
  116. for (i = 0; i < j; i++) {
  117. if (*p == '\0')
  118. do {
  119. if (RAND_bytes(p, 1) <= 0)
  120. return (0);
  121. } while (*p == '\0');
  122. p++;
  123. }
  124. *(p++) = '\0';
  125. memcpy(p, from, (unsigned int)flen);
  126. return (1);
  127. }
  128. int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
  129. const unsigned char *from, int flen,
  130. int num)
  131. {
  132. int i;
  133. /* |em| is the encoded message, zero-padded to exactly |num| bytes */
  134. unsigned char *em = NULL;
  135. unsigned int good, found_zero_byte;
  136. int zero_index = 0, msg_index, mlen = -1;
  137. if (tlen < 0 || flen < 0)
  138. return -1;
  139. /*
  140. * PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography Standard",
  141. * section 7.2.2.
  142. */
  143. if (flen > num)
  144. goto err;
  145. if (num < 11)
  146. goto err;
  147. em = OPENSSL_zalloc(num);
  148. if (em == NULL) {
  149. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);
  150. return -1;
  151. }
  152. /*
  153. * Always do this zero-padding copy (even when num == flen) to avoid
  154. * leaking that information. The copy still leaks some side-channel
  155. * information, but it's impossible to have a fixed memory access
  156. * pattern since we can't read out of the bounds of |from|.
  157. *
  158. * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL.
  159. */
  160. memcpy(em + num - flen, from, flen);
  161. good = constant_time_is_zero(em[0]);
  162. good &= constant_time_eq(em[1], 2);
  163. found_zero_byte = 0;
  164. for (i = 2; i < num; i++) {
  165. unsigned int equals0 = constant_time_is_zero(em[i]);
  166. zero_index =
  167. constant_time_select_int(~found_zero_byte & equals0, i,
  168. zero_index);
  169. found_zero_byte |= equals0;
  170. }
  171. /*
  172. * PS must be at least 8 bytes long, and it starts two bytes into |em|.
  173. * If we never found a 0-byte, then |zero_index| is 0 and the check
  174. * also fails.
  175. */
  176. good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);
  177. /*
  178. * Skip the zero byte. This is incorrect if we never found a zero-byte
  179. * but in this case we also do not copy the message out.
  180. */
  181. msg_index = zero_index + 1;
  182. mlen = num - msg_index;
  183. /*
  184. * For good measure, do this check in constant time as well; it could
  185. * leak something if |tlen| was assuming valid padding.
  186. */
  187. good &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));
  188. /*
  189. * We can't continue in constant-time because we need to copy the result
  190. * and we cannot fake its length. This unavoidably leaks timing
  191. * information at the API boundary.
  192. * TODO(emilia): this could be addressed at the call site,
  193. * see BoringSSL commit 0aa0767340baf925bda4804882aab0cb974b2d26.
  194. */
  195. if (!good) {
  196. mlen = -1;
  197. goto err;
  198. }
  199. memcpy(to, em + msg_index, mlen);
  200. err:
  201. OPENSSL_free(em);
  202. if (mlen == -1)
  203. RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,
  204. RSA_R_PKCS_DECODING_ERROR);
  205. return mlen;
  206. }