blob: 8933aa15e6779c9c1fcb149748b9c8982ac77e70 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * The RSA public-key cryptosystem
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman.
23 *
24 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf
25 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf
Janos Follath578517d2017-03-22 13:38:28 +000026 * [3] Malware Guard Extension: Using SGX to Conceal Cache Attacks
27 * Michael Schwarz, Samuel Weiser, Daniel Gruss, Clémentine Maurice and
28 * Stefan Mangard
29 * https://arxiv.org/abs/1702.08719v2
30 *
Paul Bakker5121ce52009-01-03 21:22:43 +000031 */
32
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000034#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020035#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020037#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020039#if defined(MBEDTLS_RSA_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000040
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000041#include "mbedtls/rsa.h"
42#include "mbedtls/oid.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000043
Rich Evans00ab4702015-02-06 13:43:58 +000044#include <string.h>
45
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020046#if defined(MBEDTLS_PKCS1_V21)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000047#include "mbedtls/md.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000048#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000049
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020050#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
Paul Bakker5121ce52009-01-03 21:22:43 +000051#include <stdlib.h>
Rich Evans00ab4702015-02-06 13:43:58 +000052#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020054#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000055#include "mbedtls/platform.h"
Paul Bakker7dc4c442014-02-01 22:50:26 +010056#else
Rich Evans00ab4702015-02-06 13:43:58 +000057#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020058#define mbedtls_printf printf
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +020059#define mbedtls_calloc calloc
60#define mbedtls_free free
Paul Bakker7dc4c442014-02-01 22:50:26 +010061#endif
62
Gilles Peskine8877ec22017-03-23 14:37:37 +010063/* Implementation that should never be optimized out by the compiler */
64static void mbedtls_zeroize( void *v, size_t n ) {
65 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
66}
67
Paul Bakker5121ce52009-01-03 21:22:43 +000068/*
69 * Initialize an RSA context
70 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020071void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
Paul Bakker5121ce52009-01-03 21:22:43 +000072 int padding,
Paul Bakker21eb2802010-08-16 11:10:02 +000073 int hash_id )
Paul Bakker5121ce52009-01-03 21:22:43 +000074{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020075 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000076
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020077 mbedtls_rsa_set_padding( ctx, padding, hash_id );
Paul Bakkerc9965dc2013-09-29 14:58:17 +020078
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079#if defined(MBEDTLS_THREADING_C)
80 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerc9965dc2013-09-29 14:58:17 +020081#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000082}
83
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +010084/*
85 * Set padding for an existing RSA context
86 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020087void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id )
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +010088{
89 ctx->padding = padding;
90 ctx->hash_id = hash_id;
91}
92
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093#if defined(MBEDTLS_GENPRIME)
Paul Bakker5121ce52009-01-03 21:22:43 +000094
95/*
96 * Generate an RSA keypair
97 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +000099 int (*f_rng)(void *, unsigned char *, size_t),
100 void *p_rng,
101 unsigned int nbits, int exponent )
Paul Bakker5121ce52009-01-03 21:22:43 +0000102{
103 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200104 mbedtls_mpi P1, Q1, H, G;
Paul Bakker5121ce52009-01-03 21:22:43 +0000105
Paul Bakker21eb2802010-08-16 11:10:02 +0000106 if( f_rng == NULL || nbits < 128 || exponent < 3 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000108
Janos Follath95b30362016-09-21 13:18:12 +0100109 if( nbits % 2 )
110 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
111
112 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
Janos Follath1a59a502016-02-23 14:42:48 +0000113 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &G );
Paul Bakker5121ce52009-01-03 21:22:43 +0000114
115 /*
116 * find primes P and Q with Q < P so that:
117 * GCD( E, (P-1)*(Q-1) ) == 1
118 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000120
121 do
122 {
Janos Follath1a59a502016-02-23 14:42:48 +0000123 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1, 0,
Paul Bakker21eb2802010-08-16 11:10:02 +0000124 f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000125
Janos Follath95b30362016-09-21 13:18:12 +0100126 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1, 0,
Paul Bakker21eb2802010-08-16 11:10:02 +0000127 f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200129 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000130 continue;
131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200132 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200133 if( mbedtls_mpi_bitlen( &ctx->N ) != nbits )
Paul Bakker5121ce52009-01-03 21:22:43 +0000134 continue;
135
Janos Follath95b30362016-09-21 13:18:12 +0100136 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 )
137 mbedtls_mpi_swap( &ctx->P, &ctx->Q );
138
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
140 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
141 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
142 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000143 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200144 while( mbedtls_mpi_cmp_int( &G, 1 ) != 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000145
146 /*
147 * D = E^-1 mod ((P-1)*(Q-1))
148 * DP = D mod (P - 1)
149 * DQ = D mod (Q - 1)
150 * QP = Q^-1 mod P
151 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D , &ctx->E, &H ) );
153 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) );
154 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) );
155 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000156
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200157 ctx->len = ( mbedtls_mpi_bitlen( &ctx->N ) + 7 ) >> 3;
Paul Bakker5121ce52009-01-03 21:22:43 +0000158
159cleanup:
160
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200161 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &H ); mbedtls_mpi_free( &G );
Paul Bakker5121ce52009-01-03 21:22:43 +0000162
163 if( ret != 0 )
164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 mbedtls_rsa_free( ctx );
166 return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000167 }
168
Paul Bakker48377d92013-08-30 12:06:24 +0200169 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000170}
171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_GENPRIME */
Paul Bakker5121ce52009-01-03 21:22:43 +0000173
174/*
175 * Check a public RSA key
176 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200177int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000178{
Paul Bakker37940d9f2009-07-10 22:38:58 +0000179 if( !ctx->N.p || !ctx->E.p )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200180 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker37940d9f2009-07-10 22:38:58 +0000181
Paul Bakker48377d92013-08-30 12:06:24 +0200182 if( ( ctx->N.p[0] & 1 ) == 0 ||
Paul Bakker5121ce52009-01-03 21:22:43 +0000183 ( ctx->E.p[0] & 1 ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200184 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000185
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200186 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 ||
187 mbedtls_mpi_bitlen( &ctx->N ) > MBEDTLS_MPI_MAX_BITS )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000189
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +0200190 if( mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200191 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
192 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000193
194 return( 0 );
195}
196
197/*
198 * Check a private RSA key
199 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000201{
202 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203 mbedtls_mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP;
Paul Bakker5121ce52009-01-03 21:22:43 +0000204
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200205 if( ( ret = mbedtls_rsa_check_pubkey( ctx ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000206 return( ret );
207
Paul Bakker37940d9f2009-07-10 22:38:58 +0000208 if( !ctx->P.p || !ctx->Q.p || !ctx->D.p )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200209 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker37940d9f2009-07-10 22:38:58 +0000210
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200211 mbedtls_mpi_init( &PQ ); mbedtls_mpi_init( &DE ); mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
212 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &I ); mbedtls_mpi_init( &G ); mbedtls_mpi_init( &G2 );
213 mbedtls_mpi_init( &L1 ); mbedtls_mpi_init( &L2 ); mbedtls_mpi_init( &DP ); mbedtls_mpi_init( &DQ );
214 mbedtls_mpi_init( &QP );
Paul Bakker5121ce52009-01-03 21:22:43 +0000215
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200216 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
217 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
218 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
219 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
220 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
221 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G2, &P1, &Q1 ) );
224 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L1, &L2, &H, &G2 ) );
225 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &I, &DE, &L1 ) );
Paul Bakkerb572adf2010-07-18 08:29:32 +0000226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DP, &ctx->D, &P1 ) );
228 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) );
229 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) );
Paul Bakkerb572adf2010-07-18 08:29:32 +0000230 /*
231 * Check for a valid PKCS1v2 private key
232 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200233 if( mbedtls_mpi_cmp_mpi( &PQ, &ctx->N ) != 0 ||
234 mbedtls_mpi_cmp_mpi( &DP, &ctx->DP ) != 0 ||
235 mbedtls_mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 ||
236 mbedtls_mpi_cmp_mpi( &QP, &ctx->QP ) != 0 ||
237 mbedtls_mpi_cmp_int( &L2, 0 ) != 0 ||
238 mbedtls_mpi_cmp_int( &I, 1 ) != 0 ||
239 mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200241 ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
Paul Bakker5121ce52009-01-03 21:22:43 +0000242 }
Paul Bakker48377d92013-08-30 12:06:24 +0200243
Paul Bakker5121ce52009-01-03 21:22:43 +0000244cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200245 mbedtls_mpi_free( &PQ ); mbedtls_mpi_free( &DE ); mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 );
246 mbedtls_mpi_free( &H ); mbedtls_mpi_free( &I ); mbedtls_mpi_free( &G ); mbedtls_mpi_free( &G2 );
247 mbedtls_mpi_free( &L1 ); mbedtls_mpi_free( &L2 ); mbedtls_mpi_free( &DP ); mbedtls_mpi_free( &DQ );
248 mbedtls_mpi_free( &QP );
Paul Bakker6c591fa2011-05-05 11:49:20 +0000249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200250 if( ret == MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
Paul Bakker9d781402011-05-09 16:17:09 +0000251 return( ret );
252
Paul Bakker6c591fa2011-05-05 11:49:20 +0000253 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200254 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED + ret );
Paul Bakker6c591fa2011-05-05 11:49:20 +0000255
256 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000257}
258
259/*
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100260 * Check if contexts holding a public and private key match
261 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, const mbedtls_rsa_context *prv )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100263{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200264 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
265 mbedtls_rsa_check_privkey( prv ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200267 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100268 }
269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200270 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
271 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100272 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100274 }
275
276 return( 0 );
277}
278
279/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000280 * Do an RSA public key operation
281 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200282int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000283 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000284 unsigned char *output )
285{
Paul Bakker23986e52011-04-24 08:57:21 +0000286 int ret;
287 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200288 mbedtls_mpi T;
Paul Bakker5121ce52009-01-03 21:22:43 +0000289
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200290 mbedtls_mpi_init( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000291
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200292#if defined(MBEDTLS_THREADING_C)
293 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
294 return( ret );
295#endif
296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200297 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000300 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200301 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
302 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000303 }
304
305 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200306 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
307 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000308
309cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200310#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200311 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
312 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnard88fca3e2015-03-27 15:06:07 +0100313#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 mbedtls_mpi_free( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000316
317 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200318 return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000319
320 return( 0 );
321}
322
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200323/*
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200324 * Generate or update blinding values, see section 10 of:
325 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +0200326 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200327 * Berlin Heidelberg, 1996. p. 104-113.
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200328 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200329static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200330 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
331{
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200332 int ret, count = 0;
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200333
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200334 if( ctx->Vf.p != NULL )
335 {
336 /* We already have blinding values, just update them by squaring */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200337 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
338 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
339 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
340 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200341
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200342 goto cleanup;
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200343 }
344
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200345 /* Unblinding value: Vf = random number, invertible mod N */
346 do {
347 if( count++ > 10 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200348 return( MBEDTLS_ERR_RSA_RNG_FAILED );
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200350 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
351 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) );
352 } while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200353
354 /* Blinding value: Vi = Vf^(-e) mod N */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200355 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) );
356 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200357
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +0200358
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200359cleanup:
360 return( ret );
361}
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200362
Paul Bakker5121ce52009-01-03 21:22:43 +0000363/*
Janos Follath578517d2017-03-22 13:38:28 +0000364 * Exponent blinding supposed to prevent side-channel attacks using multiple
365 * traces of measurements to recover the RSA key. The more collisions are there,
366 * the more bits of the key can be recovered. See [3].
367 *
368 * Collecting n collisions with m bit long blinding value requires 2^(m-m/n)
369 * observations on avarage.
370 *
371 * For example with 28 byte blinding to achieve 2 collisions the adversary has
372 * to make 2^112 observations on avarage.
373 *
374 * (With the currently (as of 2017 April) known best algorithms breaking 2048
375 * bit RSA requires approximately as much time as trying out 2^112 random keys.
376 * Thus in this sense with 28 byte blinding the security is not reduced by
377 * side-channel attacks like the one in [3])
378 *
379 * This countermeasure does not help if the key recovery is possible with a
380 * single trace.
381 */
382#define RSA_EXPONENT_BLINDING 28
383
384/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000385 * Do an RSA private key operation
386 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200387int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +0200388 int (*f_rng)(void *, unsigned char *, size_t),
389 void *p_rng,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000390 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000391 unsigned char *output )
392{
Paul Bakker23986e52011-04-24 08:57:21 +0000393 int ret;
394 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 mbedtls_mpi T, T1, T2;
Janos Follath9ef9f102017-03-22 15:13:15 +0000396 mbedtls_mpi P1, Q1, R;
Janos Follath578517d2017-03-22 13:38:28 +0000397#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follath9ef9f102017-03-22 15:13:15 +0000398 mbedtls_mpi D_blind;
Janos Follath578517d2017-03-22 13:38:28 +0000399 mbedtls_mpi *D = &ctx->D;
Janos Follath9ef9f102017-03-22 15:13:15 +0000400#else
401 mbedtls_mpi DP_blind, DQ_blind;
402 mbedtls_mpi *DP = &ctx->DP;
403 mbedtls_mpi *DQ = &ctx->DQ;
Janos Follath578517d2017-03-22 13:38:28 +0000404#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000405
Manuel Pégourié-Gonnard9f44a802015-10-30 10:56:25 +0100406 /* Make sure we have private key info, prevent possible misuse */
407 if( ctx->P.p == NULL || ctx->Q.p == NULL || ctx->D.p == NULL )
408 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200410 mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
Janos Follath9ef9f102017-03-22 15:13:15 +0000411 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 ); mbedtls_mpi_init( &R );
412
413
414 if( f_rng != NULL )
415 {
Janos Follath578517d2017-03-22 13:38:28 +0000416#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follath9ef9f102017-03-22 15:13:15 +0000417 mbedtls_mpi_init( &D_blind );
418#else
419 mbedtls_mpi_init( &DP_blind );
420 mbedtls_mpi_init( &DQ_blind );
Janos Follath578517d2017-03-22 13:38:28 +0000421#endif
Janos Follath9ef9f102017-03-22 15:13:15 +0000422 }
Janos Follath578517d2017-03-22 13:38:28 +0000423
Paul Bakker5121ce52009-01-03 21:22:43 +0000424
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200425#if defined(MBEDTLS_THREADING_C)
426 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
427 return( ret );
428#endif
429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200430 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
431 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000432 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200433 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
434 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000435 }
436
Paul Bakkerf451bac2013-08-30 15:37:02 +0200437 if( f_rng != NULL )
438 {
439 /*
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200440 * Blinding
441 * T = T * Vi mod N
Paul Bakkerf451bac2013-08-30 15:37:02 +0200442 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200443 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
444 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200445 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Janos Follath578517d2017-03-22 13:38:28 +0000446
Janos Follath578517d2017-03-22 13:38:28 +0000447 /*
448 * Exponent blinding
449 */
450 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
451 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
452
Janos Follath9ef9f102017-03-22 15:13:15 +0000453#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follath578517d2017-03-22 13:38:28 +0000454 /*
455 * D_blind = ( P - 1 ) * ( Q - 1 ) * R + D
456 */
457 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
458 f_rng, p_rng ) );
459 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &P1, &Q1 ) );
460 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &D_blind, &R ) );
461 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &D_blind, &D_blind, &ctx->D ) );
462
463 D = &D_blind;
Janos Follath9ef9f102017-03-22 15:13:15 +0000464#else
465 /*
466 * DP_blind = ( P - 1 ) * R + DP
467 */
468 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
469 f_rng, p_rng ) );
470 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DP_blind, &P1, &R ) );
471 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DP_blind, &DP_blind,
472 &ctx->DP ) );
473
474 DP = &DP_blind;
475
476 /*
477 * DQ_blind = ( Q - 1 ) * R + DQ
478 */
479 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
480 f_rng, p_rng ) );
481 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DQ_blind, &Q1, &R ) );
482 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DQ_blind, &DQ_blind,
483 &ctx->DQ ) );
484
485 DQ = &DQ_blind;
Janos Follath578517d2017-03-22 13:38:28 +0000486#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkerf451bac2013-08-30 15:37:02 +0200487 }
Paul Bakkeraab30c12013-08-30 11:00:25 +0200488
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200489#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follath578517d2017-03-22 13:38:28 +0000490 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, D, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnarde10e06d2014-11-06 18:15:12 +0100491#else
Paul Bakkeraab30c12013-08-30 11:00:25 +0200492 /*
Janos Follath578517d2017-03-22 13:38:28 +0000493 * Faster decryption using the CRT
Paul Bakker5121ce52009-01-03 21:22:43 +0000494 *
495 * T1 = input ^ dP mod P
496 * T2 = input ^ dQ mod Q
497 */
Janos Follath9ef9f102017-03-22 15:13:15 +0000498 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T1, &T, DP, &ctx->P, &ctx->RP ) );
499 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T2, &T, DQ, &ctx->Q, &ctx->RQ ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000500
501 /*
502 * T = (T1 - T2) * (Q^-1 mod P) mod P
503 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200504 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T1, &T2 ) );
505 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->QP ) );
506 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T1, &ctx->P ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000507
508 /*
Paul Bakkerf451bac2013-08-30 15:37:02 +0200509 * T = T2 + T * Q
Paul Bakker5121ce52009-01-03 21:22:43 +0000510 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200511 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->Q ) );
512 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &T2, &T1 ) );
513#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkeraab30c12013-08-30 11:00:25 +0200514
Paul Bakkerf451bac2013-08-30 15:37:02 +0200515 if( f_rng != NULL )
516 {
517 /*
518 * Unblind
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200519 * T = T * Vf mod N
Paul Bakkerf451bac2013-08-30 15:37:02 +0200520 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200521 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200522 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Paul Bakkerf451bac2013-08-30 15:37:02 +0200523 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000524
525 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000527
528cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200529#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200530 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
531 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +0200532#endif
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200533
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 mbedtls_mpi_free( &T ); mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 );
Janos Follath9ef9f102017-03-22 15:13:15 +0000535 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &R );
536
537 if( f_rng != NULL )
538 {
Janos Follath578517d2017-03-22 13:38:28 +0000539#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follath9ef9f102017-03-22 15:13:15 +0000540 mbedtls_mpi_free( &D_blind );
541#else
542 mbedtls_mpi_free( &DP_blind );
543 mbedtls_mpi_free( &DQ_blind );
Janos Follath578517d2017-03-22 13:38:28 +0000544#endif
Janos Follath9ef9f102017-03-22 15:13:15 +0000545 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000546
547 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548 return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000549
550 return( 0 );
551}
552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker9dcc3222011-03-08 14:16:06 +0000554/**
555 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
556 *
Paul Bakkerb125ed82011-11-10 13:33:51 +0000557 * \param dst buffer to mask
558 * \param dlen length of destination buffer
559 * \param src source of the mask generation
560 * \param slen length of the source buffer
561 * \param md_ctx message digest context to use
Paul Bakker9dcc3222011-03-08 14:16:06 +0000562 */
Paul Bakker48377d92013-08-30 12:06:24 +0200563static void mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200564 size_t slen, mbedtls_md_context_t *md_ctx )
Paul Bakker9dcc3222011-03-08 14:16:06 +0000565{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200566 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +0000567 unsigned char counter[4];
568 unsigned char *p;
Paul Bakker23986e52011-04-24 08:57:21 +0000569 unsigned int hlen;
570 size_t i, use_len;
Paul Bakker9dcc3222011-03-08 14:16:06 +0000571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
Paul Bakker9dcc3222011-03-08 14:16:06 +0000573 memset( counter, 0, 4 );
574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200575 hlen = mbedtls_md_get_size( md_ctx->md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +0000576
577 // Generate and apply dbMask
578 //
579 p = dst;
580
581 while( dlen > 0 )
582 {
583 use_len = hlen;
584 if( dlen < hlen )
585 use_len = dlen;
586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200587 mbedtls_md_starts( md_ctx );
588 mbedtls_md_update( md_ctx, src, slen );
589 mbedtls_md_update( md_ctx, counter, 4 );
590 mbedtls_md_finish( md_ctx, mask );
Paul Bakker9dcc3222011-03-08 14:16:06 +0000591
592 for( i = 0; i < use_len; ++i )
593 *p++ ^= mask[i];
594
595 counter[3]++;
596
597 dlen -= use_len;
598 }
Gilles Peskine74fd8682017-05-05 19:24:06 +0200599
600 mbedtls_zeroize( mask, sizeof( mask ) );
Paul Bakker9dcc3222011-03-08 14:16:06 +0000601}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200602#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker9dcc3222011-03-08 14:16:06 +0000603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200604#if defined(MBEDTLS_PKCS1_V21)
Paul Bakkerb3869132013-02-28 17:21:01 +0100605/*
606 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
607 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +0100609 int (*f_rng)(void *, unsigned char *, size_t),
610 void *p_rng,
Paul Bakkera43231c2013-02-28 17:33:49 +0100611 int mode,
612 const unsigned char *label, size_t label_len,
613 size_t ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +0100614 const unsigned char *input,
615 unsigned char *output )
616{
617 size_t olen;
618 int ret;
619 unsigned char *p = output;
620 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200621 const mbedtls_md_info_t *md_info;
622 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +0100623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
625 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +0200626
627 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +0100631 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200632 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100633
634 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +0100636
Janos Follathe33f5592016-02-08 14:52:29 +0000637 // first comparison checks for overflow
638 if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100640
641 memset( output, 0, olen );
642
643 *p++ = 0;
644
645 // Generate a random octet string seed
646 //
647 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +0100649
650 p += hlen;
651
652 // Construct DB
653 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654 mbedtls_md( md_info, label, label_len, p );
Paul Bakkerb3869132013-02-28 17:21:01 +0100655 p += hlen;
656 p += olen - 2 * hlen - 2 - ilen;
657 *p++ = 1;
658 memcpy( p, input, ilen );
659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200660 mbedtls_md_init( &md_ctx );
Brian J Murray88c2d222016-06-23 12:57:03 -0700661 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
662 {
663 mbedtls_md_free( &md_ctx );
664 return( ret );
665 }
Paul Bakkerb3869132013-02-28 17:21:01 +0100666
667 // maskedDB: Apply dbMask to DB
668 //
669 mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
670 &md_ctx );
671
672 // maskedSeed: Apply seedMask to seed
673 //
674 mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
675 &md_ctx );
676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 mbedtls_md_free( &md_ctx );
Paul Bakkerb3869132013-02-28 17:21:01 +0100678
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200679 return( ( mode == MBEDTLS_RSA_PUBLIC )
680 ? mbedtls_rsa_public( ctx, output, output )
681 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +0100682}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200683#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +0100684
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +0100686/*
687 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
688 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +0100690 int (*f_rng)(void *, unsigned char *, size_t),
691 void *p_rng,
692 int mode, size_t ilen,
693 const unsigned char *input,
694 unsigned char *output )
695{
696 size_t nb_pad, olen;
697 int ret;
698 unsigned char *p = output;
699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
701 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +0200702
Janos Follath689a6272016-03-18 11:45:44 +0000703 // We don't check p_rng because it won't be dereferenced here
704 if( f_rng == NULL || input == NULL || output == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200705 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100706
707 olen = ctx->len;
Janos Follathe33f5592016-02-08 14:52:29 +0000708
709 // first comparison checks for overflow
710 if( ilen + 11 < ilen || olen < ilen + 11 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100712
713 nb_pad = olen - 3 - ilen;
714
715 *p++ = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200716 if( mode == MBEDTLS_RSA_PUBLIC )
Paul Bakkerb3869132013-02-28 17:21:01 +0100717 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200718 *p++ = MBEDTLS_RSA_CRYPT;
Paul Bakkerb3869132013-02-28 17:21:01 +0100719
720 while( nb_pad-- > 0 )
721 {
722 int rng_dl = 100;
723
724 do {
725 ret = f_rng( p_rng, p, 1 );
726 } while( *p == 0 && --rng_dl && ret == 0 );
727
728 // Check if RNG failed to generate data
729 //
Paul Bakker66d5d072014-06-17 16:39:18 +0200730 if( rng_dl == 0 || ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200731 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +0100732
733 p++;
734 }
735 }
736 else
737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200738 *p++ = MBEDTLS_RSA_SIGN;
Paul Bakkerb3869132013-02-28 17:21:01 +0100739
740 while( nb_pad-- > 0 )
741 *p++ = 0xFF;
742 }
743
744 *p++ = 0;
745 memcpy( p, input, ilen );
746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200747 return( ( mode == MBEDTLS_RSA_PUBLIC )
748 ? mbedtls_rsa_public( ctx, output, output )
749 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +0100750}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200751#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +0100752
Paul Bakker5121ce52009-01-03 21:22:43 +0000753/*
754 * Add the message padding, then do an RSA operation
755 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200756int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000757 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker21eb2802010-08-16 11:10:02 +0000758 void *p_rng,
Paul Bakker23986e52011-04-24 08:57:21 +0000759 int mode, size_t ilen,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000760 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000761 unsigned char *output )
762{
Paul Bakker5121ce52009-01-03 21:22:43 +0000763 switch( ctx->padding )
764 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765#if defined(MBEDTLS_PKCS1_V15)
766 case MBEDTLS_RSA_PKCS_V15:
767 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +0100768 input, output );
Paul Bakker48377d92013-08-30 12:06:24 +0200769#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200771#if defined(MBEDTLS_PKCS1_V21)
772 case MBEDTLS_RSA_PKCS_V21:
773 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
Paul Bakkerb3869132013-02-28 17:21:01 +0100774 ilen, input, output );
Paul Bakker9dcc3222011-03-08 14:16:06 +0000775#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000776
777 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +0000779 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000780}
781
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200782#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +0000783/*
Paul Bakkerb3869132013-02-28 17:21:01 +0100784 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
Paul Bakker5121ce52009-01-03 21:22:43 +0000785 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200786int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +0200787 int (*f_rng)(void *, unsigned char *, size_t),
788 void *p_rng,
789 int mode,
Paul Bakkera43231c2013-02-28 17:33:49 +0100790 const unsigned char *label, size_t label_len,
791 size_t *olen,
Paul Bakkerb3869132013-02-28 17:21:01 +0100792 const unsigned char *input,
793 unsigned char *output,
794 size_t output_max_len )
Paul Bakker5121ce52009-01-03 21:22:43 +0000795{
Paul Bakker23986e52011-04-24 08:57:21 +0000796 int ret;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100797 size_t ilen, i, pad_len;
798 unsigned char *p, bad, pad_done;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200799 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
800 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
Paul Bakker23986e52011-04-24 08:57:21 +0000801 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200802 const mbedtls_md_info_t *md_info;
803 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +0100804
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100805 /*
806 * Parameters sanity checks
807 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200808 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
809 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000810
811 ilen = ctx->len;
812
Paul Bakker27fdf462011-06-09 13:55:13 +0000813 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200814 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200816 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100817 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200818 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100819
Janos Follath25da9b32016-02-11 11:08:18 +0000820 hlen = mbedtls_md_get_size( md_info );
821
822 // checking for integer underflow
823 if( 2 * hlen + 2 > ilen )
824 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
825
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100826 /*
827 * RSA operation
828 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200829 ret = ( mode == MBEDTLS_RSA_PUBLIC )
830 ? mbedtls_rsa_public( ctx, input, buf )
831 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +0000832
833 if( ret != 0 )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100834 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000835
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100836 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100837 * Unmask data and generate lHash
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100838 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200839 mbedtls_md_init( &md_ctx );
Brian J Murray88c2d222016-06-23 12:57:03 -0700840 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
841 {
842 mbedtls_md_free( &md_ctx );
Gilles Peskine8877ec22017-03-23 14:37:37 +0100843 goto cleanup;
Brian J Murray88c2d222016-06-23 12:57:03 -0700844 }
845
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100846
847 /* Generate lHash */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200848 mbedtls_md( md_info, label, label_len, lhash );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100849
850 /* seed: Apply seedMask to maskedSeed */
851 mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
852 &md_ctx );
853
854 /* DB: Apply dbMask to maskedDB */
855 mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
856 &md_ctx );
857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200858 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100859
860 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100861 * Check contents, in "constant-time"
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100862 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000863 p = buf;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100864 bad = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000865
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100866 bad |= *p++; /* First byte must be 0 */
Paul Bakkerb3869132013-02-28 17:21:01 +0100867
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100868 p += hlen; /* Skip seed */
Paul Bakkerb3869132013-02-28 17:21:01 +0100869
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +0100870 /* Check lHash */
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100871 for( i = 0; i < hlen; i++ )
872 bad |= lhash[i] ^ *p++;
Paul Bakkerb3869132013-02-28 17:21:01 +0100873
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100874 /* Get zero-padding len, but always read till end of buffer
875 * (minus one, for the 01 byte) */
876 pad_len = 0;
877 pad_done = 0;
878 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
879 {
880 pad_done |= p[i];
Pascal Junodb99183d2015-03-11 16:49:45 +0100881 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100882 }
Paul Bakkerb3869132013-02-28 17:21:01 +0100883
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100884 p += pad_len;
885 bad |= *p++ ^ 0x01;
Paul Bakkerb3869132013-02-28 17:21:01 +0100886
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +0100887 /*
888 * The only information "leaked" is whether the padding was correct or not
889 * (eg, no data is copied if it was not correct). This meets the
890 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
891 * the different error conditions.
892 */
893 if( bad != 0 )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100894 {
895 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
896 goto cleanup;
897 }
Paul Bakkerb3869132013-02-28 17:21:01 +0100898
Paul Bakker66d5d072014-06-17 16:39:18 +0200899 if( ilen - ( p - buf ) > output_max_len )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100900 {
901 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
902 goto cleanup;
903 }
Paul Bakkerb3869132013-02-28 17:21:01 +0100904
905 *olen = ilen - (p - buf);
906 memcpy( output, p, *olen );
Gilles Peskine8877ec22017-03-23 14:37:37 +0100907 ret = 0;
Paul Bakkerb3869132013-02-28 17:21:01 +0100908
Gilles Peskine8877ec22017-03-23 14:37:37 +0100909cleanup:
910 mbedtls_zeroize( buf, sizeof( buf ) );
911 mbedtls_zeroize( lhash, sizeof( lhash ) );
912
913 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +0100914}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200915#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +0100916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200917#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +0100918/*
919 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
920 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +0200922 int (*f_rng)(void *, unsigned char *, size_t),
923 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +0100924 int mode, size_t *olen,
925 const unsigned char *input,
926 unsigned char *output,
927 size_t output_max_len)
928{
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100929 int ret;
930 size_t ilen, pad_count = 0, i;
931 unsigned char *p, bad, pad_done = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200932 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Paul Bakkerb3869132013-02-28 17:21:01 +0100933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200934 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
935 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100936
937 ilen = ctx->len;
938
939 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +0100941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200942 ret = ( mode == MBEDTLS_RSA_PUBLIC )
943 ? mbedtls_rsa_public( ctx, input, buf )
944 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakkerb3869132013-02-28 17:21:01 +0100945
946 if( ret != 0 )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100947 goto cleanup;
Paul Bakkerb3869132013-02-28 17:21:01 +0100948
949 p = buf;
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100950 bad = 0;
Paul Bakkerb3869132013-02-28 17:21:01 +0100951
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100952 /*
953 * Check and get padding len in "constant-time"
954 */
955 bad |= *p++; /* First byte must be 0 */
Paul Bakkerb3869132013-02-28 17:21:01 +0100956
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100957 /* This test does not depend on secret data */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200958 if( mode == MBEDTLS_RSA_PRIVATE )
Paul Bakker5121ce52009-01-03 21:22:43 +0000959 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200960 bad |= *p++ ^ MBEDTLS_RSA_CRYPT;
Paul Bakker5121ce52009-01-03 21:22:43 +0000961
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100962 /* Get padding len, but always read till end of buffer
963 * (minus one, for the 00 byte) */
964 for( i = 0; i < ilen - 3; i++ )
965 {
Pascal Junodb99183d2015-03-11 16:49:45 +0100966 pad_done |= ((p[i] | (unsigned char)-p[i]) >> 7) ^ 1;
967 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100968 }
Paul Bakkere6ee41f2012-05-19 08:43:48 +0000969
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100970 p += pad_count;
971 bad |= *p++; /* Must be zero */
Paul Bakkerb3869132013-02-28 17:21:01 +0100972 }
973 else
974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200975 bad |= *p++ ^ MBEDTLS_RSA_SIGN;
Paul Bakkerb3869132013-02-28 17:21:01 +0100976
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100977 /* Get padding len, but always read till end of buffer
978 * (minus one, for the 00 byte) */
979 for( i = 0; i < ilen - 3; i++ )
980 {
Manuel Pégourié-Gonnardfbf09152014-02-03 11:58:55 +0100981 pad_done |= ( p[i] != 0xFF );
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100982 pad_count += ( pad_done == 0 );
983 }
Paul Bakkerb3869132013-02-28 17:21:01 +0100984
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100985 p += pad_count;
986 bad |= *p++; /* Must be zero */
Paul Bakker5121ce52009-01-03 21:22:43 +0000987 }
988
Janos Follathe007c9f2016-02-12 13:30:09 +0000989 bad |= ( pad_count < 8 );
Janos Follatha9583432016-02-08 13:59:25 +0000990
Manuel Pégourié-Gonnard27290da2013-11-30 13:36:53 +0100991 if( bad )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100992 {
993 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
994 goto cleanup;
995 }
Paul Bakker8804f692013-02-28 18:06:26 +0100996
Paul Bakker66d5d072014-06-17 16:39:18 +0200997 if( ilen - ( p - buf ) > output_max_len )
Gilles Peskine8877ec22017-03-23 14:37:37 +0100998 {
999 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
1000 goto cleanup;
1001 }
Paul Bakker060c5682009-01-12 21:48:39 +00001002
Paul Bakker27fdf462011-06-09 13:55:13 +00001003 *olen = ilen - (p - buf);
Paul Bakker5121ce52009-01-03 21:22:43 +00001004 memcpy( output, p, *olen );
Gilles Peskine8877ec22017-03-23 14:37:37 +01001005 ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001006
Gilles Peskine8877ec22017-03-23 14:37:37 +01001007cleanup:
1008 mbedtls_zeroize( buf, sizeof( buf ) );
1009
1010 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001011}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001012#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001013
1014/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001015 * Do an RSA operation, then remove the message padding
1016 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001017int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001018 int (*f_rng)(void *, unsigned char *, size_t),
1019 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001020 int mode, size_t *olen,
1021 const unsigned char *input,
1022 unsigned char *output,
1023 size_t output_max_len)
1024{
1025 switch( ctx->padding )
1026 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001027#if defined(MBEDTLS_PKCS1_V15)
1028 case MBEDTLS_RSA_PKCS_V15:
1029 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
Paul Bakker548957d2013-08-30 10:30:02 +02001030 input, output, output_max_len );
Paul Bakker48377d92013-08-30 12:06:24 +02001031#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01001032
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033#if defined(MBEDTLS_PKCS1_V21)
1034 case MBEDTLS_RSA_PKCS_V21:
1035 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
Paul Bakker548957d2013-08-30 10:30:02 +02001036 olen, input, output,
1037 output_max_len );
Paul Bakkerb3869132013-02-28 17:21:01 +01001038#endif
1039
1040 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001041 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001042 }
1043}
1044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001045#if defined(MBEDTLS_PKCS1_V21)
Paul Bakkerb3869132013-02-28 17:21:01 +01001046/*
1047 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
1048 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001050 int (*f_rng)(void *, unsigned char *, size_t),
1051 void *p_rng,
1052 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001053 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001054 unsigned int hashlen,
1055 const unsigned char *hash,
1056 unsigned char *sig )
1057{
1058 size_t olen;
1059 unsigned char *p = sig;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 unsigned char salt[MBEDTLS_MD_MAX_SIZE];
Paul Bakkerb3869132013-02-28 17:21:01 +01001061 unsigned int slen, hlen, offset = 0;
1062 int ret;
1063 size_t msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001064 const mbedtls_md_info_t *md_info;
1065 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1068 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001069
1070 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001072
1073 olen = ctx->len;
1074
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001075 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001076 {
Paul Bakkerc70b9822013-04-07 22:00:46 +02001077 // Gather length of hash to sign
1078 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001079 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001080 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001081 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001083 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001084 }
1085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001086 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001087 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001088 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001089
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001090 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001091 slen = hlen;
1092
1093 if( olen < hlen + slen + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001094 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001095
1096 memset( sig, 0, olen );
1097
Paul Bakkerb3869132013-02-28 17:21:01 +01001098 // Generate salt of length slen
1099 //
1100 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001101 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001102
1103 // Note: EMSA-PSS encoding is over the length of N - 1 bits
1104 //
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001105 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakkerb3869132013-02-28 17:21:01 +01001106 p += olen - hlen * 2 - 2;
1107 *p++ = 0x01;
1108 memcpy( p, salt, slen );
1109 p += slen;
1110
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001111 mbedtls_md_init( &md_ctx );
Brian J Murray88c2d222016-06-23 12:57:03 -07001112 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
1113 {
1114 mbedtls_md_free( &md_ctx );
Gilles Peskine74fd8682017-05-05 19:24:06 +02001115 /* No need to zeroize salt: we didn't use it. */
Brian J Murray88c2d222016-06-23 12:57:03 -07001116 return( ret );
1117 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001118
1119 // Generate H = Hash( M' )
1120 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001121 mbedtls_md_starts( &md_ctx );
1122 mbedtls_md_update( &md_ctx, p, 8 );
1123 mbedtls_md_update( &md_ctx, hash, hashlen );
1124 mbedtls_md_update( &md_ctx, salt, slen );
1125 mbedtls_md_finish( &md_ctx, p );
Gilles Peskine74fd8682017-05-05 19:24:06 +02001126 mbedtls_zeroize( salt, sizeof( salt ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001127
1128 // Compensate for boundary condition when applying mask
1129 //
1130 if( msb % 8 == 0 )
1131 offset = 1;
1132
1133 // maskedDB: Apply dbMask to DB
1134 //
1135 mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx );
1136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001137 mbedtls_md_free( &md_ctx );
Paul Bakkerb3869132013-02-28 17:21:01 +01001138
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001139 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakkerb3869132013-02-28 17:21:01 +01001140 sig[0] &= 0xFF >> ( olen * 8 - msb );
1141
1142 p += hlen;
1143 *p++ = 0xBC;
1144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001145 return( ( mode == MBEDTLS_RSA_PUBLIC )
1146 ? mbedtls_rsa_public( ctx, sig, sig )
1147 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001148}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001149#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001151#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001152/*
1153 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
1154 */
1155/*
1156 * Do an RSA operation to sign the message digest
1157 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001158int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001159 int (*f_rng)(void *, unsigned char *, size_t),
1160 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001161 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001162 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001163 unsigned int hashlen,
1164 const unsigned char *hash,
1165 unsigned char *sig )
1166{
Paul Bakkerc70b9822013-04-07 22:00:46 +02001167 size_t nb_pad, olen, oid_size = 0;
Paul Bakkerb3869132013-02-28 17:21:01 +01001168 unsigned char *p = sig;
Paul Bakker21e081b2014-07-24 10:38:01 +02001169 const char *oid = NULL;
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02001170 unsigned char *sig_try = NULL, *verif = NULL;
1171 size_t i;
1172 unsigned char diff;
1173 volatile unsigned char diff_no_optimize;
1174 int ret;
Paul Bakkerb3869132013-02-28 17:21:01 +01001175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
1177 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001178
1179 olen = ctx->len;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001180 nb_pad = olen - 3;
Paul Bakkerb3869132013-02-28 17:21:01 +01001181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001182 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001183 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001184 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001185 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001186 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
1189 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001190
Paul Bakkerc70b9822013-04-07 22:00:46 +02001191 nb_pad -= 10 + oid_size;
1192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001193 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001194 }
1195
Paul Bakkerc70b9822013-04-07 22:00:46 +02001196 nb_pad -= hashlen;
1197
Paul Bakkerb3869132013-02-28 17:21:01 +01001198 if( ( nb_pad < 8 ) || ( nb_pad > olen ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001200
1201 *p++ = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001202 *p++ = MBEDTLS_RSA_SIGN;
Paul Bakkerb3869132013-02-28 17:21:01 +01001203 memset( p, 0xFF, nb_pad );
1204 p += nb_pad;
1205 *p++ = 0;
1206
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001207 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001208 {
Paul Bakkerc70b9822013-04-07 22:00:46 +02001209 memcpy( p, hash, hashlen );
1210 }
1211 else
1212 {
1213 /*
1214 * DigestInfo ::= SEQUENCE {
1215 * digestAlgorithm DigestAlgorithmIdentifier,
1216 * digest Digest }
1217 *
1218 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
1219 *
1220 * Digest ::= OCTET STRING
1221 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001223 *p++ = (unsigned char) ( 0x08 + oid_size + hashlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001224 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001225 *p++ = (unsigned char) ( 0x04 + oid_size );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001226 *p++ = MBEDTLS_ASN1_OID;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001227 *p++ = oid_size & 0xFF;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001228 memcpy( p, oid, oid_size );
1229 p += oid_size;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001230 *p++ = MBEDTLS_ASN1_NULL;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001231 *p++ = 0x00;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001232 *p++ = MBEDTLS_ASN1_OCTET_STRING;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001233 *p++ = hashlen;
1234 memcpy( p, hash, hashlen );
Paul Bakkerb3869132013-02-28 17:21:01 +01001235 }
1236
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02001237 if( mode == MBEDTLS_RSA_PUBLIC )
1238 return( mbedtls_rsa_public( ctx, sig, sig ) );
1239
1240 /*
1241 * In order to prevent Lenstra's attack, make the signature in a
1242 * temporary buffer and check it before returning it.
1243 */
1244 sig_try = mbedtls_calloc( 1, ctx->len );
Simon Butcher318daf02016-01-01 21:42:47 +00001245 if( sig_try == NULL )
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02001246 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
1247
Simon Butcher318daf02016-01-01 21:42:47 +00001248 verif = mbedtls_calloc( 1, ctx->len );
1249 if( verif == NULL )
1250 {
1251 mbedtls_free( sig_try );
1252 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
1253 }
1254
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02001255 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
1256 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
1257
1258 /* Compare in constant time just in case */
1259 for( diff = 0, i = 0; i < ctx->len; i++ )
1260 diff |= verif[i] ^ sig[i];
1261 diff_no_optimize = diff;
1262
1263 if( diff_no_optimize != 0 )
1264 {
1265 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
1266 goto cleanup;
1267 }
1268
1269 memcpy( sig, sig_try, ctx->len );
1270
1271cleanup:
1272 mbedtls_free( sig_try );
1273 mbedtls_free( verif );
1274
1275 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001276}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001277#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001278
1279/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001280 * Do an RSA operation to sign the message digest
1281 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001282int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001283 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker9dcc3222011-03-08 14:16:06 +00001284 void *p_rng,
Paul Bakker5121ce52009-01-03 21:22:43 +00001285 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001286 mbedtls_md_type_t md_alg,
Paul Bakker23986e52011-04-24 08:57:21 +00001287 unsigned int hashlen,
Paul Bakkerff60ee62010-03-16 21:09:09 +00001288 const unsigned char *hash,
Paul Bakker5121ce52009-01-03 21:22:43 +00001289 unsigned char *sig )
1290{
Paul Bakker5121ce52009-01-03 21:22:43 +00001291 switch( ctx->padding )
1292 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001293#if defined(MBEDTLS_PKCS1_V15)
1294 case MBEDTLS_RSA_PKCS_V15:
1295 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001296 hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02001297#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001299#if defined(MBEDTLS_PKCS1_V21)
1300 case MBEDTLS_RSA_PKCS_V21:
1301 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001302 hashlen, hash, sig );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001303#endif
1304
Paul Bakker5121ce52009-01-03 21:22:43 +00001305 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +00001307 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001308}
1309
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001310#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +00001311/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001312 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
Paul Bakker5121ce52009-01-03 21:22:43 +00001313 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001314int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001315 int (*f_rng)(void *, unsigned char *, size_t),
1316 void *p_rng,
1317 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001318 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001319 unsigned int hashlen,
1320 const unsigned char *hash,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001321 mbedtls_md_type_t mgf1_hash_id,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001322 int expected_salt_len,
1323 const unsigned char *sig )
Paul Bakker5121ce52009-01-03 21:22:43 +00001324{
Paul Bakker23986e52011-04-24 08:57:21 +00001325 int ret;
Paul Bakkerb3869132013-02-28 17:21:01 +01001326 size_t siglen;
1327 unsigned char *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001328 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Gilles Peskined0cd8552017-10-17 19:02:13 +02001329 unsigned char *hash_start;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001330 unsigned char result[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +00001331 unsigned char zeros[8];
Paul Bakker23986e52011-04-24 08:57:21 +00001332 unsigned int hlen;
Gilles Peskined0cd8552017-10-17 19:02:13 +02001333 size_t observed_salt_len, msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001334 const mbedtls_md_info_t *md_info;
1335 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001337 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1338 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001339
Paul Bakker5121ce52009-01-03 21:22:43 +00001340 siglen = ctx->len;
1341
Paul Bakker27fdf462011-06-09 13:55:13 +00001342 if( siglen < 16 || siglen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001343 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00001344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001345 ret = ( mode == MBEDTLS_RSA_PUBLIC )
1346 ? mbedtls_rsa_public( ctx, sig, buf )
1347 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00001348
1349 if( ret != 0 )
1350 return( ret );
1351
1352 p = buf;
1353
Paul Bakkerb3869132013-02-28 17:21:01 +01001354 if( buf[siglen - 1] != 0xBC )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001357 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001358 {
Paul Bakkerc70b9822013-04-07 22:00:46 +02001359 // Gather length of hash to sign
1360 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001361 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001362 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001363 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001364
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001365 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001366 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00001367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001368 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001369 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001370 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001372 hlen = mbedtls_md_get_size( md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001373
Paul Bakkerb3869132013-02-28 17:21:01 +01001374 memset( zeros, 0, 8 );
Paul Bakker53019ae2011-03-25 13:58:48 +00001375
Paul Bakkerb3869132013-02-28 17:21:01 +01001376 // Note: EMSA-PSS verification is over the length of N - 1 bits
1377 //
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001378 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001379
Paul Bakkerb3869132013-02-28 17:21:01 +01001380 // Compensate for boundary condition when applying mask
1381 //
1382 if( msb % 8 == 0 )
1383 {
1384 p++;
1385 siglen -= 1;
1386 }
Gilles Peskined0cd8552017-10-17 19:02:13 +02001387 else
Paul Bakkerb3869132013-02-28 17:21:01 +01001388 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001389 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001390
Gilles Peskine9e205822017-10-18 19:03:42 +02001391 if( siglen < hlen + 2 )
1392 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1393 hash_start = p + siglen - hlen - 1;
1394
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001395 mbedtls_md_init( &md_ctx );
Brian J Murray88c2d222016-06-23 12:57:03 -07001396 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
1397 {
1398 mbedtls_md_free( &md_ctx );
1399 return( ret );
1400 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00001401
Gilles Peskined0cd8552017-10-17 19:02:13 +02001402 mgf_mask( p, siglen - hlen - 1, hash_start, hlen, &md_ctx );
Paul Bakker02303e82013-01-03 11:08:31 +01001403
Paul Bakkerb3869132013-02-28 17:21:01 +01001404 buf[0] &= 0xFF >> ( siglen * 8 - msb );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001405
Gilles Peskined0cd8552017-10-17 19:02:13 +02001406 while( p < hash_start - 1 && *p == 0 )
Paul Bakkerb3869132013-02-28 17:21:01 +01001407 p++;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001408
Gilles Peskined0cd8552017-10-17 19:02:13 +02001409 if( p == hash_start ||
Paul Bakkerb3869132013-02-28 17:21:01 +01001410 *p++ != 0x01 )
1411 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001412 mbedtls_md_free( &md_ctx );
1413 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001414 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00001415
Gilles Peskined0cd8552017-10-17 19:02:13 +02001416 observed_salt_len = hash_start - p;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001417
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001418 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
Gilles Peskined0cd8552017-10-17 19:02:13 +02001419 observed_salt_len != (size_t) expected_salt_len )
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001420 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001421 mbedtls_md_free( &md_ctx );
1422 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001423 }
1424
Paul Bakkerb3869132013-02-28 17:21:01 +01001425 // Generate H = Hash( M' )
1426 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427 mbedtls_md_starts( &md_ctx );
1428 mbedtls_md_update( &md_ctx, zeros, 8 );
1429 mbedtls_md_update( &md_ctx, hash, hashlen );
Gilles Peskined0cd8552017-10-17 19:02:13 +02001430 mbedtls_md_update( &md_ctx, p, observed_salt_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001431 mbedtls_md_finish( &md_ctx, result );
Paul Bakker53019ae2011-03-25 13:58:48 +00001432
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001433 mbedtls_md_free( &md_ctx );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001434
Gilles Peskined0cd8552017-10-17 19:02:13 +02001435 if( memcmp( hash_start, result, hlen ) == 0 )
Paul Bakkerb3869132013-02-28 17:21:01 +01001436 return( 0 );
1437 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001438 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerb3869132013-02-28 17:21:01 +01001439}
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001440
1441/*
1442 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
1443 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001444int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001445 int (*f_rng)(void *, unsigned char *, size_t),
1446 void *p_rng,
1447 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001448 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001449 unsigned int hashlen,
1450 const unsigned char *hash,
1451 const unsigned char *sig )
1452{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001453 mbedtls_md_type_t mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
1454 ? (mbedtls_md_type_t) ctx->hash_id
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001455 : md_alg;
1456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001457 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001458 md_alg, hashlen, hash,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001459 mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02001460 sig ) );
1461
1462}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001463#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker40628ba2013-01-03 10:50:31 +01001464
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001465#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001466/*
1467 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
1468 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001469int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001470 int (*f_rng)(void *, unsigned char *, size_t),
1471 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001472 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001473 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001474 unsigned int hashlen,
1475 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02001476 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01001477{
1478 int ret;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001479 size_t len, siglen, asn1_len;
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001480 unsigned char *p, *p0, *end;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001481 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
1482 mbedtls_md_type_t msg_md_alg;
1483 const mbedtls_md_info_t *md_info;
1484 mbedtls_asn1_buf oid;
Paul Bakkerb3869132013-02-28 17:21:01 +01001485
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001486 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
1487 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001488
1489 siglen = ctx->len;
1490
1491 if( siglen < 16 || siglen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494 ret = ( mode == MBEDTLS_RSA_PUBLIC )
1495 ? mbedtls_rsa_public( ctx, sig, buf )
1496 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
Paul Bakkerb3869132013-02-28 17:21:01 +01001497
1498 if( ret != 0 )
1499 return( ret );
1500
1501 p = buf;
1502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001503 if( *p++ != 0 || *p++ != MBEDTLS_RSA_SIGN )
1504 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001505
1506 while( *p != 0 )
1507 {
1508 if( p >= buf + siglen - 1 || *p != 0xFF )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001509 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001510 p++;
1511 }
Manuel Pégourié-Gonnard230ee312017-05-11 12:49:51 +02001512 p++; /* skip 00 byte */
1513
1514 /* We've read: 00 01 PS 00 where PS must be at least 8 bytes */
1515 if( p - buf < 11 )
1516 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001517
1518 len = siglen - ( p - buf );
1519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001520 if( len == hashlen && md_alg == MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001521 {
1522 if( memcmp( p, hash, hashlen ) == 0 )
1523 return( 0 );
1524 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001525 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +00001526 }
1527
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001528 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001529 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001530 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1531 hashlen = mbedtls_md_get_size( md_info );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001532
1533 end = p + len;
1534
Gilles Peskinebd908512017-05-04 12:48:39 +02001535 /*
1536 * Parse the ASN.1 structure inside the PKCS#1 v1.5 structure.
1537 * Insist on 2-byte length tags, to protect against variants of
1538 * Bleichenbacher's forgery attack against lax PKCS#1v1.5 verification.
1539 */
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001540 p0 = p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
1542 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
1543 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001544 if( p != p0 + 2 || asn1_len + 2 != len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001545 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001546
Gilles Peskinebd908512017-05-04 12:48:39 +02001547 p0 = p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001548 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
1549 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
1550 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Gilles Peskinebd908512017-05-04 12:48:39 +02001551 if( p != p0 + 2 || asn1_len + 6 + hashlen != len )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001552 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001553
Gilles Peskinebd908512017-05-04 12:48:39 +02001554 p0 = p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001555 if( ( ret = mbedtls_asn1_get_tag( &p, end, &oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
1556 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Gilles Peskinebd908512017-05-04 12:48:39 +02001557 if( p != p0 + 2 )
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001558 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001559
1560 oid.p = p;
1561 p += oid.len;
1562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001563 if( mbedtls_oid_get_md_alg( &oid, &msg_md_alg ) != 0 )
1564 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001565
1566 if( md_alg != msg_md_alg )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001567 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001568
1569 /*
1570 * assume the algorithm parameters must be NULL
1571 */
Gilles Peskinebd908512017-05-04 12:48:39 +02001572 p0 = p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001573 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_NULL ) ) != 0 )
1574 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Gilles Peskinebd908512017-05-04 12:48:39 +02001575 if( p != p0 + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001576 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001577
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001578 p0 = p;
Paul Bakkerc70b9822013-04-07 22:00:46 +02001579 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
1580 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Gilles Peskinefd8f79d2017-05-03 18:32:21 +02001581 if( p != p0 + 2 || asn1_len != hashlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001583
1584 if( memcmp( p, hash, hashlen ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001585 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001586
1587 p += hashlen;
1588
1589 if( p != end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001590 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001591
1592 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001593}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001594#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001595
1596/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001597 * Do an RSA operation and check the message digest
1598 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001599int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001600 int (*f_rng)(void *, unsigned char *, size_t),
1601 void *p_rng,
Paul Bakkerb3869132013-02-28 17:21:01 +01001602 int mode,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001603 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001604 unsigned int hashlen,
1605 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02001606 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01001607{
1608 switch( ctx->padding )
1609 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001610#if defined(MBEDTLS_PKCS1_V15)
1611 case MBEDTLS_RSA_PKCS_V15:
1612 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001613 hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02001614#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01001615
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001616#if defined(MBEDTLS_PKCS1_V21)
1617 case MBEDTLS_RSA_PKCS_V21:
1618 return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001619 hashlen, hash, sig );
1620#endif
1621
1622 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001623 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001624 }
1625}
1626
1627/*
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001628 * Copy the components of an RSA key
1629 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001630int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001631{
1632 int ret;
1633
1634 dst->ver = src->ver;
1635 dst->len = src->len;
1636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
1638 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001640 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
1641 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
1642 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
1643 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
1644 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
1645 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
1648 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
1649 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001651 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
1652 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +02001653
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001654 dst->padding = src->padding;
Manuel Pégourié-Gonnardfdddac92014-03-25 15:58:35 +01001655 dst->hash_id = src->hash_id;
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001656
1657cleanup:
1658 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001659 mbedtls_rsa_free( dst );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02001660
1661 return( ret );
1662}
1663
1664/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001665 * Free the components of an RSA key
1666 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001667void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +00001668{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001669 mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->Vf );
1670 mbedtls_mpi_free( &ctx->RQ ); mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->RN );
1671 mbedtls_mpi_free( &ctx->QP ); mbedtls_mpi_free( &ctx->DQ ); mbedtls_mpi_free( &ctx->DP );
1672 mbedtls_mpi_free( &ctx->Q ); mbedtls_mpi_free( &ctx->P ); mbedtls_mpi_free( &ctx->D );
1673 mbedtls_mpi_free( &ctx->E ); mbedtls_mpi_free( &ctx->N );
Paul Bakkerc9965dc2013-09-29 14:58:17 +02001674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001675#if defined(MBEDTLS_THREADING_C)
1676 mbedtls_mutex_free( &ctx->mutex );
Paul Bakkerc9965dc2013-09-29 14:58:17 +02001677#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001678}
1679
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001680#if defined(MBEDTLS_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +00001681
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00001682#include "mbedtls/sha1.h"
Paul Bakker5121ce52009-01-03 21:22:43 +00001683
1684/*
1685 * Example RSA-1024 keypair, for test purposes
1686 */
1687#define KEY_LEN 128
1688
1689#define RSA_N "9292758453063D803DD603D5E777D788" \
1690 "8ED1D5BF35786190FA2F23EBC0848AEA" \
1691 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
1692 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
1693 "93A89813FBF3C4F8066D2D800F7C38A8" \
1694 "1AE31942917403FF4946B0A83D3D3E05" \
1695 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
1696 "5E94BB77B07507233A0BC7BAC8F90F79"
1697
1698#define RSA_E "10001"
1699
1700#define RSA_D "24BF6185468786FDD303083D25E64EFC" \
1701 "66CA472BC44D253102F8B4A9D3BFA750" \
1702 "91386C0077937FE33FA3252D28855837" \
1703 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
1704 "DF79C5CE07EE72C7F123142198164234" \
1705 "CABB724CF78B8173B9F880FC86322407" \
1706 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
1707 "071513A1E85B5DFA031F21ECAE91A34D"
1708
1709#define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
1710 "2C01CAD19EA484A87EA4377637E75500" \
1711 "FCB2005C5C7DD6EC4AC023CDA285D796" \
1712 "C3D9E75E1EFC42488BB4F1D13AC30A57"
1713
1714#define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
1715 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
1716 "910E4168387E3C30AA1E00C339A79508" \
1717 "8452DD96A9A5EA5D9DCA68DA636032AF"
1718
1719#define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \
1720 "3C94D22288ACD763FD8E5600ED4A702D" \
1721 "F84198A5F06C2E72236AE490C93F07F8" \
1722 "3CC559CD27BC2D1CA488811730BB5725"
1723
1724#define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \
1725 "D8AAEA56749EA28623272E4F7D0592AF" \
1726 "7C1F1313CAC9471B5C523BFE592F517B" \
1727 "407A1BD76C164B93DA2D32A383E58357"
1728
1729#define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \
1730 "F38D18D2B2F0E2DD275AA977E2BF4411" \
1731 "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
1732 "A74206CEC169D74BF5A8C50D6F48EA08"
1733
1734#define PT_LEN 24
1735#define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
1736 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
1737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001738#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkera3d195c2011-11-27 21:07:34 +00001739static int myrand( void *rng_state, unsigned char *output, size_t len )
Paul Bakker545570e2010-07-18 09:00:25 +00001740{
Paul Bakkerf96f7b62014-04-30 16:02:38 +02001741#if !defined(__OpenBSD__)
Paul Bakkera3d195c2011-11-27 21:07:34 +00001742 size_t i;
1743
Paul Bakker545570e2010-07-18 09:00:25 +00001744 if( rng_state != NULL )
1745 rng_state = NULL;
1746
Paul Bakkera3d195c2011-11-27 21:07:34 +00001747 for( i = 0; i < len; ++i )
1748 output[i] = rand();
Paul Bakkerf96f7b62014-04-30 16:02:38 +02001749#else
1750 if( rng_state != NULL )
1751 rng_state = NULL;
1752
1753 arc4random_buf( output, len );
1754#endif /* !OpenBSD */
Paul Bakker48377d92013-08-30 12:06:24 +02001755
Paul Bakkera3d195c2011-11-27 21:07:34 +00001756 return( 0 );
Paul Bakker545570e2010-07-18 09:00:25 +00001757}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001758#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker545570e2010-07-18 09:00:25 +00001759
Paul Bakker5121ce52009-01-03 21:22:43 +00001760/*
1761 * Checkup routine
1762 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001763int mbedtls_rsa_self_test( int verbose )
Paul Bakker5121ce52009-01-03 21:22:43 +00001764{
Paul Bakker3d8fb632014-04-17 12:42:41 +02001765 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001766#if defined(MBEDTLS_PKCS1_V15)
Paul Bakker23986e52011-04-24 08:57:21 +00001767 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001768 mbedtls_rsa_context rsa;
Paul Bakker5121ce52009-01-03 21:22:43 +00001769 unsigned char rsa_plaintext[PT_LEN];
1770 unsigned char rsa_decrypted[PT_LEN];
1771 unsigned char rsa_ciphertext[KEY_LEN];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001772#if defined(MBEDTLS_SHA1_C)
Paul Bakker5690efc2011-05-26 13:16:06 +00001773 unsigned char sha1sum[20];
1774#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001776 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001777
1778 rsa.len = KEY_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001779 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.N , 16, RSA_N ) );
1780 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.E , 16, RSA_E ) );
1781 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.D , 16, RSA_D ) );
1782 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.P , 16, RSA_P ) );
1783 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.Q , 16, RSA_Q ) );
1784 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DP, 16, RSA_DP ) );
1785 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DQ, 16, RSA_DQ ) );
1786 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.QP, 16, RSA_QP ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001787
1788 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001789 mbedtls_printf( " RSA key validation: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00001790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001791 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
1792 mbedtls_rsa_check_privkey( &rsa ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001793 {
1794 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001795 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001796
1797 return( 1 );
1798 }
1799
1800 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001801 mbedtls_printf( "passed\n PKCS#1 encryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00001802
1803 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
1804
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001805 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
Paul Bakker5121ce52009-01-03 21:22:43 +00001806 rsa_plaintext, rsa_ciphertext ) != 0 )
1807 {
1808 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001809 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001810
1811 return( 1 );
1812 }
1813
1814 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815 mbedtls_printf( "passed\n PKCS#1 decryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00001816
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001817 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
Paul Bakker060c5682009-01-12 21:48:39 +00001818 rsa_ciphertext, rsa_decrypted,
Paul Bakker23986e52011-04-24 08:57:21 +00001819 sizeof(rsa_decrypted) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001820 {
1821 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001822 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001823
1824 return( 1 );
1825 }
1826
1827 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
1828 {
1829 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001830 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001831
1832 return( 1 );
1833 }
1834
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02001835 if( verbose != 0 )
1836 mbedtls_printf( "passed\n" );
1837
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838#if defined(MBEDTLS_SHA1_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00001839 if( verbose != 0 )
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02001840 mbedtls_printf( "PKCS#1 data sign : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00001841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001842 mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00001843
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001844 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
Paul Bakker5121ce52009-01-03 21:22:43 +00001845 sha1sum, rsa_ciphertext ) != 0 )
1846 {
1847 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001849
1850 return( 1 );
1851 }
1852
1853 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001854 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00001855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001856 if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
Paul Bakker5121ce52009-01-03 21:22:43 +00001857 sha1sum, rsa_ciphertext ) != 0 )
1858 {
1859 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001860 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001861
1862 return( 1 );
1863 }
1864
1865 if( verbose != 0 )
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02001866 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867#endif /* MBEDTLS_SHA1_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001868
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02001869 if( verbose != 0 )
1870 mbedtls_printf( "\n" );
1871
Paul Bakker3d8fb632014-04-17 12:42:41 +02001872cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001873 mbedtls_rsa_free( &rsa );
1874#else /* MBEDTLS_PKCS1_V15 */
Paul Bakker3e41fe82013-09-15 17:42:50 +02001875 ((void) verbose);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001876#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker3d8fb632014-04-17 12:42:41 +02001877 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001878}
1879
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001880#endif /* MBEDTLS_SELF_TEST */
Paul Bakker5121ce52009-01-03 21:22:43 +00001881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001882#endif /* MBEDTLS_RSA_C */