blob: 9c110378c719b20e68606d3c60180c82580c20aa [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * The RSA public-key cryptosystem
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
Hanno Becker74716312017-10-02 10:00:37 +010019
Paul Bakker5121ce52009-01-03 21:22:43 +000020/*
Simon Butcherbdae02c2016-01-20 00:44:42 +000021 * The following sources were referenced in the design of this implementation
22 * of the RSA algorithm:
Paul Bakker5121ce52009-01-03 21:22:43 +000023 *
Simon Butcherbdae02c2016-01-20 00:44:42 +000024 * [1] A method for obtaining digital signatures and public-key cryptosystems
25 * R Rivest, A Shamir, and L Adleman
26 * http://people.csail.mit.edu/rivest/pubs.html#RSA78
27 *
28 * [2] Handbook of Applied Cryptography - 1997, Chapter 8
29 * Menezes, van Oorschot and Vanstone
30 *
Janos Follathe81102e2017-03-22 13:38:28 +000031 * [3] Malware Guard Extension: Using SGX to Conceal Cache Attacks
32 * Michael Schwarz, Samuel Weiser, Daniel Gruss, Clémentine Maurice and
33 * Stefan Mangard
34 * https://arxiv.org/abs/1702.08719v2
35 *
Paul Bakker5121ce52009-01-03 21:22:43 +000036 */
37
Gilles Peskinedb09ef62020-06-03 01:43:33 +020038#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000039
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020040#if defined(MBEDTLS_RSA_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000041
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000042#include "mbedtls/rsa.h"
Chris Jones66a4cd42021-03-09 16:04:12 +000043#include "rsa_alt_helpers.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000044#include "mbedtls/oid.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050045#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000046#include "mbedtls/error.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000047
Rich Evans00ab4702015-02-06 13:43:58 +000048#include <string.h>
49
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020050#if defined(MBEDTLS_PKCS1_V21)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000051#include "mbedtls/md.h"
Paul Bakkerbb51f0c2012-08-23 07:46:58 +000052#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000053
gufe44c2620da2020-08-03 17:56:50 +020054#if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__) && !defined(__NetBSD__)
Paul Bakker5121ce52009-01-03 21:22:43 +000055#include <stdlib.h>
Rich Evans00ab4702015-02-06 13:43:58 +000056#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020058#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000059#include "mbedtls/platform.h"
Paul Bakker7dc4c442014-02-01 22:50:26 +010060#else
Rich Evans00ab4702015-02-06 13:43:58 +000061#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020062#define mbedtls_printf printf
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +020063#define mbedtls_calloc calloc
64#define mbedtls_free free
Paul Bakker7dc4c442014-02-01 22:50:26 +010065#endif
66
Hanno Beckera565f542017-10-11 11:00:19 +010067#if !defined(MBEDTLS_RSA_ALT)
68
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050069/* Parameter validation macros */
70#define RSA_VALIDATE_RET( cond ) \
71 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_RSA_BAD_INPUT_DATA )
72#define RSA_VALIDATE( cond ) \
73 MBEDTLS_INTERNAL_VALIDATE( cond )
74
Manuel Pégourié-Gonnard1ba8a3f2018-03-13 13:27:14 +010075#if defined(MBEDTLS_PKCS1_V15)
Hanno Becker171a8f12017-09-06 12:32:16 +010076/* constant-time buffer comparison */
77static inline int mbedtls_safer_memcmp( const void *a, const void *b, size_t n )
78{
79 size_t i;
80 const unsigned char *A = (const unsigned char *) a;
81 const unsigned char *B = (const unsigned char *) b;
82 unsigned char diff = 0;
83
84 for( i = 0; i < n; i++ )
85 diff |= A[i] ^ B[i];
86
87 return( diff );
88}
Manuel Pégourié-Gonnard1ba8a3f2018-03-13 13:27:14 +010089#endif /* MBEDTLS_PKCS1_V15 */
Hanno Becker171a8f12017-09-06 12:32:16 +010090
Hanno Becker617c1ae2017-08-23 14:11:24 +010091int mbedtls_rsa_import( mbedtls_rsa_context *ctx,
92 const mbedtls_mpi *N,
93 const mbedtls_mpi *P, const mbedtls_mpi *Q,
94 const mbedtls_mpi *D, const mbedtls_mpi *E )
95{
Janos Follath24eed8d2019-11-22 13:21:35 +000096 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050097 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +010098
99 if( ( N != NULL && ( ret = mbedtls_mpi_copy( &ctx->N, N ) ) != 0 ) ||
100 ( P != NULL && ( ret = mbedtls_mpi_copy( &ctx->P, P ) ) != 0 ) ||
101 ( Q != NULL && ( ret = mbedtls_mpi_copy( &ctx->Q, Q ) ) != 0 ) ||
102 ( D != NULL && ( ret = mbedtls_mpi_copy( &ctx->D, D ) ) != 0 ) ||
103 ( E != NULL && ( ret = mbedtls_mpi_copy( &ctx->E, E ) ) != 0 ) )
104 {
Chris Jonesb7d02e02021-04-01 17:40:03 +0100105 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100106 }
107
108 if( N != NULL )
109 ctx->len = mbedtls_mpi_size( &ctx->N );
110
111 return( 0 );
112}
113
114int mbedtls_rsa_import_raw( mbedtls_rsa_context *ctx,
Hanno Becker74716312017-10-02 10:00:37 +0100115 unsigned char const *N, size_t N_len,
116 unsigned char const *P, size_t P_len,
117 unsigned char const *Q, size_t Q_len,
118 unsigned char const *D, size_t D_len,
119 unsigned char const *E, size_t E_len )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100120{
Hanno Beckerd4d60572018-01-10 07:12:01 +0000121 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500122 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100123
124 if( N != NULL )
125 {
126 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->N, N, N_len ) );
127 ctx->len = mbedtls_mpi_size( &ctx->N );
128 }
129
130 if( P != NULL )
131 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->P, P, P_len ) );
132
133 if( Q != NULL )
134 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->Q, Q, Q_len ) );
135
136 if( D != NULL )
137 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->D, D, D_len ) );
138
139 if( E != NULL )
140 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &ctx->E, E, E_len ) );
141
142cleanup:
143
144 if( ret != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +0100145 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100146
147 return( 0 );
148}
149
Hanno Becker705fc682017-10-10 17:57:02 +0100150/*
151 * Checks whether the context fields are set in such a way
152 * that the RSA primitives will be able to execute without error.
153 * It does *not* make guarantees for consistency of the parameters.
154 */
Hanno Beckerebd2c022017-10-12 10:54:53 +0100155static int rsa_check_context( mbedtls_rsa_context const *ctx, int is_priv,
156 int blinding_needed )
Hanno Becker705fc682017-10-10 17:57:02 +0100157{
Hanno Beckerebd2c022017-10-12 10:54:53 +0100158#if !defined(MBEDTLS_RSA_NO_CRT)
159 /* blinding_needed is only used for NO_CRT to decide whether
160 * P,Q need to be present or not. */
161 ((void) blinding_needed);
162#endif
163
Hanno Becker3a760a12018-01-05 08:14:49 +0000164 if( ctx->len != mbedtls_mpi_size( &ctx->N ) ||
165 ctx->len > MBEDTLS_MPI_MAX_SIZE )
166 {
Hanno Becker705fc682017-10-10 17:57:02 +0100167 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Hanno Becker3a760a12018-01-05 08:14:49 +0000168 }
Hanno Becker705fc682017-10-10 17:57:02 +0100169
170 /*
171 * 1. Modular exponentiation needs positive, odd moduli.
172 */
173
174 /* Modular exponentiation wrt. N is always used for
175 * RSA public key operations. */
176 if( mbedtls_mpi_cmp_int( &ctx->N, 0 ) <= 0 ||
177 mbedtls_mpi_get_bit( &ctx->N, 0 ) == 0 )
178 {
179 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
180 }
181
182#if !defined(MBEDTLS_RSA_NO_CRT)
183 /* Modular exponentiation for P and Q is only
184 * used for private key operations and if CRT
185 * is used. */
186 if( is_priv &&
187 ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) <= 0 ||
188 mbedtls_mpi_get_bit( &ctx->P, 0 ) == 0 ||
189 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ||
190 mbedtls_mpi_get_bit( &ctx->Q, 0 ) == 0 ) )
191 {
192 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
193 }
194#endif /* !MBEDTLS_RSA_NO_CRT */
195
196 /*
197 * 2. Exponents must be positive
198 */
199
200 /* Always need E for public key operations */
201 if( mbedtls_mpi_cmp_int( &ctx->E, 0 ) <= 0 )
202 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
203
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100204#if defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker705fc682017-10-10 17:57:02 +0100205 /* For private key operations, use D or DP & DQ
206 * as (unblinded) exponents. */
207 if( is_priv && mbedtls_mpi_cmp_int( &ctx->D, 0 ) <= 0 )
208 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
209#else
210 if( is_priv &&
211 ( mbedtls_mpi_cmp_int( &ctx->DP, 0 ) <= 0 ||
212 mbedtls_mpi_cmp_int( &ctx->DQ, 0 ) <= 0 ) )
213 {
214 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
215 }
216#endif /* MBEDTLS_RSA_NO_CRT */
217
218 /* Blinding shouldn't make exponents negative either,
219 * so check that P, Q >= 1 if that hasn't yet been
220 * done as part of 1. */
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100221#if defined(MBEDTLS_RSA_NO_CRT)
Hanno Beckerebd2c022017-10-12 10:54:53 +0100222 if( is_priv && blinding_needed &&
Hanno Becker705fc682017-10-10 17:57:02 +0100223 ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) <= 0 ||
224 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ) )
225 {
226 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
227 }
228#endif
229
230 /* It wouldn't lead to an error if it wasn't satisfied,
Hanno Beckerf8c028a2017-10-17 09:20:57 +0100231 * but check for QP >= 1 nonetheless. */
Hanno Beckerb82a5b52017-10-11 19:10:23 +0100232#if !defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker705fc682017-10-10 17:57:02 +0100233 if( is_priv &&
234 mbedtls_mpi_cmp_int( &ctx->QP, 0 ) <= 0 )
235 {
236 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
237 }
238#endif
239
240 return( 0 );
241}
242
Hanno Beckerf9e184b2017-10-10 16:49:26 +0100243int mbedtls_rsa_complete( mbedtls_rsa_context *ctx )
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100244{
245 int ret = 0;
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500246 int have_N, have_P, have_Q, have_D, have_E;
247#if !defined(MBEDTLS_RSA_NO_CRT)
248 int have_DP, have_DQ, have_QP;
249#endif
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500250 int n_missing, pq_missing, d_missing, is_pub, is_priv;
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100251
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500252 RSA_VALIDATE_RET( ctx != NULL );
253
254 have_N = ( mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 );
255 have_P = ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 );
256 have_Q = ( mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 );
257 have_D = ( mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 );
258 have_E = ( mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0 );
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500259
260#if !defined(MBEDTLS_RSA_NO_CRT)
Jack Lloyd80cc8112020-01-22 17:34:29 -0500261 have_DP = ( mbedtls_mpi_cmp_int( &ctx->DP, 0 ) != 0 );
262 have_DQ = ( mbedtls_mpi_cmp_int( &ctx->DQ, 0 ) != 0 );
263 have_QP = ( mbedtls_mpi_cmp_int( &ctx->QP, 0 ) != 0 );
Jack Lloyd8c2631b2020-01-23 17:23:52 -0500264#endif
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100265
Hanno Becker617c1ae2017-08-23 14:11:24 +0100266 /*
267 * Check whether provided parameters are enough
268 * to deduce all others. The following incomplete
269 * parameter sets for private keys are supported:
270 *
271 * (1) P, Q missing.
272 * (2) D and potentially N missing.
273 *
274 */
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100275
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500276 n_missing = have_P && have_Q && have_D && have_E;
277 pq_missing = have_N && !have_P && !have_Q && have_D && have_E;
278 d_missing = have_P && have_Q && !have_D && have_E;
279 is_pub = have_N && !have_P && !have_Q && !have_D && have_E;
Hanno Becker2cca6f32017-09-29 11:46:40 +0100280
281 /* These three alternatives are mutually exclusive */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500282 is_priv = n_missing || pq_missing || d_missing;
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100283
Hanno Becker617c1ae2017-08-23 14:11:24 +0100284 if( !is_priv && !is_pub )
285 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
286
287 /*
Hanno Becker2cca6f32017-09-29 11:46:40 +0100288 * Step 1: Deduce N if P, Q are provided.
289 */
290
291 if( !have_N && have_P && have_Q )
292 {
293 if( ( ret = mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P,
294 &ctx->Q ) ) != 0 )
295 {
Chris Jonesb7d02e02021-04-01 17:40:03 +0100296 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker2cca6f32017-09-29 11:46:40 +0100297 }
298
299 ctx->len = mbedtls_mpi_size( &ctx->N );
300 }
301
302 /*
303 * Step 2: Deduce and verify all remaining core parameters.
Hanno Becker617c1ae2017-08-23 14:11:24 +0100304 */
305
306 if( pq_missing )
307 {
Hanno Beckerc36aab62017-10-17 09:15:06 +0100308 ret = mbedtls_rsa_deduce_primes( &ctx->N, &ctx->E, &ctx->D,
Hanno Becker617c1ae2017-08-23 14:11:24 +0100309 &ctx->P, &ctx->Q );
310 if( ret != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +0100311 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100312
313 }
314 else if( d_missing )
315 {
Hanno Becker8ba6ce42017-10-03 14:36:26 +0100316 if( ( ret = mbedtls_rsa_deduce_private_exponent( &ctx->P,
317 &ctx->Q,
318 &ctx->E,
319 &ctx->D ) ) != 0 )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100320 {
Chris Jonesb7d02e02021-04-01 17:40:03 +0100321 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100322 }
323 }
Hanno Becker617c1ae2017-08-23 14:11:24 +0100324
Hanno Becker617c1ae2017-08-23 14:11:24 +0100325 /*
Hanno Becker2cca6f32017-09-29 11:46:40 +0100326 * Step 3: Deduce all additional parameters specific
Hanno Beckere8674892017-10-10 17:56:14 +0100327 * to our current RSA implementation.
Hanno Becker617c1ae2017-08-23 14:11:24 +0100328 */
329
Hanno Becker23344b52017-08-23 07:43:27 +0100330#if !defined(MBEDTLS_RSA_NO_CRT)
Jack Lloyd2e9eef42020-01-28 14:43:52 -0500331 if( is_priv && ! ( have_DP && have_DQ && have_QP ) )
Hanno Becker617c1ae2017-08-23 14:11:24 +0100332 {
333 ret = mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
334 &ctx->DP, &ctx->DQ, &ctx->QP );
335 if( ret != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +0100336 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100337 }
Hanno Becker23344b52017-08-23 07:43:27 +0100338#endif /* MBEDTLS_RSA_NO_CRT */
Hanno Becker617c1ae2017-08-23 14:11:24 +0100339
340 /*
Hanno Becker705fc682017-10-10 17:57:02 +0100341 * Step 3: Basic sanity checks
Hanno Becker617c1ae2017-08-23 14:11:24 +0100342 */
343
Hanno Beckerebd2c022017-10-12 10:54:53 +0100344 return( rsa_check_context( ctx, is_priv, 1 ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100345}
346
Hanno Becker617c1ae2017-08-23 14:11:24 +0100347int mbedtls_rsa_export_raw( const mbedtls_rsa_context *ctx,
348 unsigned char *N, size_t N_len,
349 unsigned char *P, size_t P_len,
350 unsigned char *Q, size_t Q_len,
351 unsigned char *D, size_t D_len,
352 unsigned char *E, size_t E_len )
353{
354 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500355 int is_priv;
356 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100357
358 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500359 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100360 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
361 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
362 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
363 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
364 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
365
366 if( !is_priv )
367 {
368 /* If we're trying to export private parameters for a public key,
369 * something must be wrong. */
370 if( P != NULL || Q != NULL || D != NULL )
371 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
372
373 }
374
375 if( N != NULL )
376 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->N, N, N_len ) );
377
378 if( P != NULL )
379 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->P, P, P_len ) );
380
381 if( Q != NULL )
382 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->Q, Q, Q_len ) );
383
384 if( D != NULL )
385 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->D, D, D_len ) );
386
387 if( E != NULL )
388 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &ctx->E, E, E_len ) );
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100389
390cleanup:
391
392 return( ret );
393}
394
Hanno Becker617c1ae2017-08-23 14:11:24 +0100395int mbedtls_rsa_export( const mbedtls_rsa_context *ctx,
396 mbedtls_mpi *N, mbedtls_mpi *P, mbedtls_mpi *Q,
397 mbedtls_mpi *D, mbedtls_mpi *E )
398{
Janos Follath24eed8d2019-11-22 13:21:35 +0000399 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500400 int is_priv;
401 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100402
403 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500404 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100405 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
406 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
407 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
408 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
409 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
410
411 if( !is_priv )
412 {
413 /* If we're trying to export private parameters for a public key,
414 * something must be wrong. */
415 if( P != NULL || Q != NULL || D != NULL )
416 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
417
418 }
419
420 /* Export all requested core parameters. */
421
422 if( ( N != NULL && ( ret = mbedtls_mpi_copy( N, &ctx->N ) ) != 0 ) ||
423 ( P != NULL && ( ret = mbedtls_mpi_copy( P, &ctx->P ) ) != 0 ) ||
424 ( Q != NULL && ( ret = mbedtls_mpi_copy( Q, &ctx->Q ) ) != 0 ) ||
425 ( D != NULL && ( ret = mbedtls_mpi_copy( D, &ctx->D ) ) != 0 ) ||
426 ( E != NULL && ( ret = mbedtls_mpi_copy( E, &ctx->E ) ) != 0 ) )
427 {
428 return( ret );
429 }
430
431 return( 0 );
432}
433
434/*
435 * Export CRT parameters
436 * This must also be implemented if CRT is not used, for being able to
437 * write DER encoded RSA keys. The helper function mbedtls_rsa_deduce_crt
438 * can be used in this case.
439 */
440int mbedtls_rsa_export_crt( const mbedtls_rsa_context *ctx,
441 mbedtls_mpi *DP, mbedtls_mpi *DQ, mbedtls_mpi *QP )
442{
Janos Follath24eed8d2019-11-22 13:21:35 +0000443 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500444 int is_priv;
445 RSA_VALIDATE_RET( ctx != NULL );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100446
447 /* Check if key is private or public */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500448 is_priv =
Hanno Becker617c1ae2017-08-23 14:11:24 +0100449 mbedtls_mpi_cmp_int( &ctx->N, 0 ) != 0 &&
450 mbedtls_mpi_cmp_int( &ctx->P, 0 ) != 0 &&
451 mbedtls_mpi_cmp_int( &ctx->Q, 0 ) != 0 &&
452 mbedtls_mpi_cmp_int( &ctx->D, 0 ) != 0 &&
453 mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
454
455 if( !is_priv )
456 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
457
Hanno Beckerdc95c892017-08-23 06:57:02 +0100458#if !defined(MBEDTLS_RSA_NO_CRT)
Hanno Becker617c1ae2017-08-23 14:11:24 +0100459 /* Export all requested blinding parameters. */
Hanno Becker617c1ae2017-08-23 14:11:24 +0100460 if( ( DP != NULL && ( ret = mbedtls_mpi_copy( DP, &ctx->DP ) ) != 0 ) ||
461 ( DQ != NULL && ( ret = mbedtls_mpi_copy( DQ, &ctx->DQ ) ) != 0 ) ||
462 ( QP != NULL && ( ret = mbedtls_mpi_copy( QP, &ctx->QP ) ) != 0 ) )
463 {
Chris Jonesb7d02e02021-04-01 17:40:03 +0100464 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100465 }
Hanno Beckerdc95c892017-08-23 06:57:02 +0100466#else
467 if( ( ret = mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
468 DP, DQ, QP ) ) != 0 )
469 {
Chris Jonesb7d02e02021-04-01 17:40:03 +0100470 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
Hanno Beckerdc95c892017-08-23 06:57:02 +0100471 }
472#endif
Hanno Becker617c1ae2017-08-23 14:11:24 +0100473
474 return( 0 );
475}
Hanno Beckere2e8b8d2017-08-23 14:06:45 +0100476
Paul Bakker5121ce52009-01-03 21:22:43 +0000477/*
478 * Initialize an RSA context
479 */
Ronald Cronc1905a12021-06-05 11:11:14 +0200480void mbedtls_rsa_init( mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000481{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500482 RSA_VALIDATE( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200484 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000485
Ronald Cronc1905a12021-06-05 11:11:14 +0200486 ctx->padding = MBEDTLS_RSA_PKCS_V15;
487 ctx->hash_id = MBEDTLS_MD_NONE;
Paul Bakkerc9965dc2013-09-29 14:58:17 +0200488
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200489#if defined(MBEDTLS_THREADING_C)
Gilles Peskineeb940592021-02-01 17:57:41 +0100490 /* Set ctx->ver to nonzero to indicate that the mutex has been
491 * initialized and will need to be freed. */
492 ctx->ver = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493 mbedtls_mutex_init( &ctx->mutex );
Paul Bakkerc9965dc2013-09-29 14:58:17 +0200494#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000495}
496
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100497/*
498 * Set padding for an existing RSA context
499 */
Ronald Cronea7631b2021-06-03 18:51:59 +0200500int mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding,
501 mbedtls_md_type_t hash_id )
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100502{
Ronald Cron3a0375f2021-06-08 10:22:28 +0200503 switch( padding )
504 {
505#if defined(MBEDTLS_PKCS1_V15)
506 case MBEDTLS_RSA_PKCS_V15:
507 break;
508#endif
509
510#if defined(MBEDTLS_PKCS1_V21)
511 case MBEDTLS_RSA_PKCS_V21:
512 break;
513#endif
514 default:
515 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
516 }
Ronald Cronea7631b2021-06-03 18:51:59 +0200517
518 if( ( padding == MBEDTLS_RSA_PKCS_V21 ) &&
519 ( hash_id != MBEDTLS_MD_NONE ) )
520 {
521 const mbedtls_md_info_t *md_info;
522
523 md_info = mbedtls_md_info_from_type( hash_id );
524 if( md_info == NULL )
525 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
526 }
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500527
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100528 ctx->padding = padding;
529 ctx->hash_id = hash_id;
Ronald Cronea7631b2021-06-03 18:51:59 +0200530
531 return( 0 );
Manuel Pégourié-Gonnard844a4c02014-03-10 21:55:35 +0100532}
533
Hanno Becker617c1ae2017-08-23 14:11:24 +0100534/*
535 * Get length in bytes of RSA modulus
536 */
537
538size_t mbedtls_rsa_get_len( const mbedtls_rsa_context *ctx )
539{
Hanno Becker2f8f06a2017-09-29 11:47:26 +0100540 return( ctx->len );
Hanno Becker617c1ae2017-08-23 14:11:24 +0100541}
542
543
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200544#if defined(MBEDTLS_GENPRIME)
Paul Bakker5121ce52009-01-03 21:22:43 +0000545
546/*
547 * Generate an RSA keypair
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800548 *
549 * This generation method follows the RSA key pair generation procedure of
550 * FIPS 186-4 if 2^16 < exponent < 2^256 and nbits = 2048 or nbits = 3072.
Paul Bakker5121ce52009-01-03 21:22:43 +0000551 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200552int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +0000553 int (*f_rng)(void *, unsigned char *, size_t),
554 void *p_rng,
555 unsigned int nbits, int exponent )
Paul Bakker5121ce52009-01-03 21:22:43 +0000556{
Janos Follath24eed8d2019-11-22 13:21:35 +0000557 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jethro Beekman97f95c92018-02-13 15:50:36 -0800558 mbedtls_mpi H, G, L;
Janos Follathb8fc1b02018-09-03 15:37:01 +0100559 int prime_quality = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500560 RSA_VALIDATE_RET( ctx != NULL );
561 RSA_VALIDATE_RET( f_rng != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000562
Janos Follathb8fc1b02018-09-03 15:37:01 +0100563 /*
564 * If the modulus is 1024 bit long or shorter, then the security strength of
565 * the RSA algorithm is less than or equal to 80 bits and therefore an error
566 * rate of 2^-80 is sufficient.
567 */
568 if( nbits > 1024 )
569 prime_quality = MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR;
570
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100571 mbedtls_mpi_init( &H );
572 mbedtls_mpi_init( &G );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800573 mbedtls_mpi_init( &L );
Paul Bakker5121ce52009-01-03 21:22:43 +0000574
Gilles Peskine5e40a7c2021-02-02 21:06:10 +0100575 if( nbits < 128 || exponent < 3 || nbits % 2 != 0 )
576 {
577 ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
578 goto cleanup;
579 }
580
Paul Bakker5121ce52009-01-03 21:22:43 +0000581 /*
582 * find primes P and Q with Q < P so that:
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800583 * 1. |P-Q| > 2^( nbits / 2 - 100 )
584 * 2. GCD( E, (P-1)*(Q-1) ) == 1
585 * 3. E^-1 mod LCM(P-1, Q-1) > 2^( nbits / 2 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000586 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200587 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000588
589 do
590 {
Janos Follathb8fc1b02018-09-03 15:37:01 +0100591 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, nbits >> 1,
592 prime_quality, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000593
Janos Follathb8fc1b02018-09-03 15:37:01 +0100594 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, nbits >> 1,
595 prime_quality, f_rng, p_rng ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000596
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800597 /* make sure the difference between p and q is not too small (FIPS 186-4 §B.3.3 step 5.4) */
598 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &H, &ctx->P, &ctx->Q ) );
599 if( mbedtls_mpi_bitlen( &H ) <= ( ( nbits >= 200 ) ? ( ( nbits >> 1 ) - 99 ) : 0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +0000600 continue;
601
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800602 /* not required by any standards, but some users rely on the fact that P > Q */
603 if( H.s < 0 )
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100604 mbedtls_mpi_swap( &ctx->P, &ctx->Q );
Janos Follathef441782016-09-21 13:18:12 +0100605
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100606 /* Temporarily replace P,Q by P-1, Q-1 */
607 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &ctx->P, &ctx->P, 1 ) );
608 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &ctx->Q, &ctx->Q, 1 ) );
609 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &ctx->P, &ctx->Q ) );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800610
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800611 /* check GCD( E, (P-1)*(Q-1) ) == 1 (FIPS 186-4 §B.3.1 criterion 2(a)) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200612 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800613 if( mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
614 continue;
615
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800616 /* compute smallest possible D = E^-1 mod LCM(P-1, Q-1) (FIPS 186-4 §B.3.1 criterion 3(b)) */
Jethro Beekman97f95c92018-02-13 15:50:36 -0800617 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->P, &ctx->Q ) );
618 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L, NULL, &H, &G ) );
619 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D, &ctx->E, &L ) );
620
621 if( mbedtls_mpi_bitlen( &ctx->D ) <= ( ( nbits + 1 ) / 2 ) ) // (FIPS 186-4 §B.3.1 criterion 3(a))
622 continue;
623
624 break;
Paul Bakker5121ce52009-01-03 21:22:43 +0000625 }
Jethro Beekman97f95c92018-02-13 15:50:36 -0800626 while( 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000627
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100628 /* Restore P,Q */
629 MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &ctx->P, &ctx->P, 1 ) );
630 MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &ctx->Q, &ctx->Q, 1 ) );
631
Jethro Beekmanc645bfe2018-02-14 19:27:13 -0800632 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
633
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100634 ctx->len = mbedtls_mpi_size( &ctx->N );
635
Jethro Beekman97f95c92018-02-13 15:50:36 -0800636#if !defined(MBEDTLS_RSA_NO_CRT)
Paul Bakker5121ce52009-01-03 21:22:43 +0000637 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000638 * DP = D mod (P - 1)
639 * DQ = D mod (Q - 1)
640 * QP = Q^-1 mod P
641 */
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100642 MBEDTLS_MPI_CHK( mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
643 &ctx->DP, &ctx->DQ, &ctx->QP ) );
644#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakker5121ce52009-01-03 21:22:43 +0000645
Hanno Becker83aad1f2017-08-23 06:45:10 +0100646 /* Double-check */
647 MBEDTLS_MPI_CHK( mbedtls_rsa_check_privkey( ctx ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000648
649cleanup:
650
Hanno Beckerbee3aae2017-08-23 06:59:15 +0100651 mbedtls_mpi_free( &H );
652 mbedtls_mpi_free( &G );
Jethro Beekman97f95c92018-02-13 15:50:36 -0800653 mbedtls_mpi_free( &L );
Paul Bakker5121ce52009-01-03 21:22:43 +0000654
655 if( ret != 0 )
656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200657 mbedtls_rsa_free( ctx );
Chris Jones74392092021-04-01 16:00:01 +0100658
Gilles Peskine5e40a7c2021-02-02 21:06:10 +0100659 if( ( -ret & ~0x7f ) == 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +0100660 ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_KEY_GEN_FAILED, ret );
Gilles Peskine5e40a7c2021-02-02 21:06:10 +0100661 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000662 }
663
Paul Bakker48377d92013-08-30 12:06:24 +0200664 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000665}
666
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200667#endif /* MBEDTLS_GENPRIME */
Paul Bakker5121ce52009-01-03 21:22:43 +0000668
669/*
670 * Check a public RSA key
671 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000673{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500674 RSA_VALIDATE_RET( ctx != NULL );
675
Hanno Beckerebd2c022017-10-12 10:54:53 +0100676 if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker37940d9f2009-07-10 22:38:58 +0000678
Hanno Becker3a760a12018-01-05 08:14:49 +0000679 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 )
Hanno Becker98838b02017-10-02 13:16:10 +0100680 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Hanno Becker98838b02017-10-02 13:16:10 +0100682 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000683
Hanno Becker705fc682017-10-10 17:57:02 +0100684 if( mbedtls_mpi_get_bit( &ctx->E, 0 ) == 0 ||
685 mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200686 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
Hanno Becker98838b02017-10-02 13:16:10 +0100687 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200688 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Hanno Becker98838b02017-10-02 13:16:10 +0100689 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000690
691 return( 0 );
692}
693
694/*
Hanno Becker705fc682017-10-10 17:57:02 +0100695 * Check for the consistency of all fields in an RSA private key context
Paul Bakker5121ce52009-01-03 21:22:43 +0000696 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200697int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +0000698{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500699 RSA_VALIDATE_RET( ctx != NULL );
700
Hanno Becker705fc682017-10-10 17:57:02 +0100701 if( mbedtls_rsa_check_pubkey( ctx ) != 0 ||
Hanno Beckerebd2c022017-10-12 10:54:53 +0100702 rsa_check_context( ctx, 1 /* private */, 1 /* blinding */ ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000703 {
Hanno Becker98838b02017-10-02 13:16:10 +0100704 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000705 }
Paul Bakker48377d92013-08-30 12:06:24 +0200706
Hanno Becker98838b02017-10-02 13:16:10 +0100707 if( mbedtls_rsa_validate_params( &ctx->N, &ctx->P, &ctx->Q,
Hanno Beckerb269a852017-08-25 08:03:21 +0100708 &ctx->D, &ctx->E, NULL, NULL ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000709 {
Hanno Beckerb269a852017-08-25 08:03:21 +0100710 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +0000711 }
Paul Bakker6c591fa2011-05-05 11:49:20 +0000712
Hanno Beckerb269a852017-08-25 08:03:21 +0100713#if !defined(MBEDTLS_RSA_NO_CRT)
714 else if( mbedtls_rsa_validate_crt( &ctx->P, &ctx->Q, &ctx->D,
715 &ctx->DP, &ctx->DQ, &ctx->QP ) != 0 )
716 {
717 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
718 }
719#endif
Paul Bakker6c591fa2011-05-05 11:49:20 +0000720
721 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000722}
723
724/*
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100725 * Check if contexts holding a public and private key match
726 */
Hanno Becker98838b02017-10-02 13:16:10 +0100727int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub,
728 const mbedtls_rsa_context *prv )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100729{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500730 RSA_VALIDATE_RET( pub != NULL );
731 RSA_VALIDATE_RET( prv != NULL );
732
Hanno Becker98838b02017-10-02 13:16:10 +0100733 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 mbedtls_rsa_check_privkey( prv ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100735 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200736 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100737 }
738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
740 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100741 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200742 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
Manuel Pégourié-Gonnard2f8d1f92014-11-06 14:02:51 +0100743 }
744
745 return( 0 );
746}
747
748/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000749 * Do an RSA public key operation
750 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200751int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000752 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000753 unsigned char *output )
754{
Janos Follath24eed8d2019-11-22 13:21:35 +0000755 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +0000756 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200757 mbedtls_mpi T;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500758 RSA_VALIDATE_RET( ctx != NULL );
759 RSA_VALIDATE_RET( input != NULL );
760 RSA_VALIDATE_RET( output != NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +0000761
Hanno Beckerebd2c022017-10-12 10:54:53 +0100762 if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) )
Hanno Becker705fc682017-10-10 17:57:02 +0100763 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765 mbedtls_mpi_init( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000766
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200767#if defined(MBEDTLS_THREADING_C)
768 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
769 return( ret );
770#endif
771
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200772 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000773
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200774 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000775 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200776 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
777 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000778 }
779
780 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
782 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000783
784cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200786 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
787 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnard88fca3e2015-03-27 15:06:07 +0100788#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000789
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200790 mbedtls_mpi_free( &T );
Paul Bakker5121ce52009-01-03 21:22:43 +0000791
792 if( ret != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +0100793 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PUBLIC_FAILED, ret ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000794
795 return( 0 );
796}
797
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200798/*
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200799 * Generate or update blinding values, see section 10 of:
800 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +0200801 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200802 * Berlin Heidelberg, 1996. p. 104-113.
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200803 */
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200804static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200805 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
806{
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200807 int ret, count = 0;
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200808 mbedtls_mpi R;
809
810 mbedtls_mpi_init( &R );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200811
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200812 if( ctx->Vf.p != NULL )
813 {
814 /* We already have blinding values, just update them by squaring */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200815 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
816 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
817 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
818 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200819
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200820 goto cleanup;
Manuel Pégourié-Gonnard8a109f12013-09-10 13:37:26 +0200821 }
822
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200823 /* Unblinding value: Vf = random number, invertible mod N */
824 do {
825 if( count++ > 10 )
Manuel Pégourié-Gonnarde288ec02020-07-16 09:23:30 +0200826 {
827 ret = MBEDTLS_ERR_RSA_RNG_FAILED;
828 goto cleanup;
829 }
Manuel Pégourié-Gonnard4d89c7e2013-10-04 15:18:38 +0200830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200831 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200832
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200833 /* Compute Vf^-1 as R * (R Vf)^-1 to avoid leaks from inv_mod. */
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200834 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, ctx->len - 1, f_rng, p_rng ) );
835 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vf, &R ) );
836 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
837
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200838 /* At this point, Vi is invertible mod N if and only if both Vf and R
839 * are invertible mod N. If one of them isn't, we don't need to know
840 * which one, we just loop and choose new values for both of them.
841 * (Each iteration succeeds with overwhelming probability.) */
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200842 ret = mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vi, &ctx->N );
Peter Kolbusca8b8e72020-09-24 11:11:50 -0500843 if( ret != 0 && ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
Manuel Pégourié-Gonnardb3e3d792020-06-26 11:03:19 +0200844 goto cleanup;
845
Peter Kolbusca8b8e72020-09-24 11:11:50 -0500846 } while( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
847
848 /* Finish the computation of Vf^-1 = R * (R Vf)^-1 */
849 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &R ) );
850 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200851
Manuel Pégourié-Gonnard78683962020-07-16 09:48:54 +0200852 /* Blinding value: Vi = Vf^(-e) mod N
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200853 * (Vi already contains Vf^-1 at this point) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200855
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +0200856
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200857cleanup:
Manuel Pégourié-Gonnard750d3c72020-06-26 11:19:12 +0200858 mbedtls_mpi_free( &R );
859
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200860 return( ret );
861}
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +0200862
Paul Bakker5121ce52009-01-03 21:22:43 +0000863/*
Janos Follathe81102e2017-03-22 13:38:28 +0000864 * Exponent blinding supposed to prevent side-channel attacks using multiple
865 * traces of measurements to recover the RSA key. The more collisions are there,
866 * the more bits of the key can be recovered. See [3].
867 *
868 * Collecting n collisions with m bit long blinding value requires 2^(m-m/n)
869 * observations on avarage.
870 *
871 * For example with 28 byte blinding to achieve 2 collisions the adversary has
872 * to make 2^112 observations on avarage.
873 *
874 * (With the currently (as of 2017 April) known best algorithms breaking 2048
875 * bit RSA requires approximately as much time as trying out 2^112 random keys.
876 * Thus in this sense with 28 byte blinding the security is not reduced by
877 * side-channel attacks like the one in [3])
878 *
879 * This countermeasure does not help if the key recovery is possible with a
880 * single trace.
881 */
882#define RSA_EXPONENT_BLINDING 28
883
884/*
Paul Bakker5121ce52009-01-03 21:22:43 +0000885 * Do an RSA private key operation
886 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200887int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +0200888 int (*f_rng)(void *, unsigned char *, size_t),
889 void *p_rng,
Paul Bakkerff60ee62010-03-16 21:09:09 +0000890 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +0000891 unsigned char *output )
892{
Janos Follath24eed8d2019-11-22 13:21:35 +0000893 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23986e52011-04-24 08:57:21 +0000894 size_t olen;
Hanno Becker06811ce2017-05-03 15:10:34 +0100895
896 /* Temporary holding the result */
897 mbedtls_mpi T;
898
899 /* Temporaries holding P-1, Q-1 and the
900 * exponent blinding factor, respectively. */
Janos Follathf9203b42017-03-22 15:13:15 +0000901 mbedtls_mpi P1, Q1, R;
Hanno Becker06811ce2017-05-03 15:10:34 +0100902
903#if !defined(MBEDTLS_RSA_NO_CRT)
904 /* Temporaries holding the results mod p resp. mod q. */
905 mbedtls_mpi TP, TQ;
906
907 /* Temporaries holding the blinded exponents for
908 * the mod p resp. mod q computation (if used). */
Janos Follathf9203b42017-03-22 15:13:15 +0000909 mbedtls_mpi DP_blind, DQ_blind;
Hanno Becker06811ce2017-05-03 15:10:34 +0100910
911 /* Pointers to actual exponents to be used - either the unblinded
912 * or the blinded ones, depending on the presence of a PRNG. */
Janos Follathf9203b42017-03-22 15:13:15 +0000913 mbedtls_mpi *DP = &ctx->DP;
914 mbedtls_mpi *DQ = &ctx->DQ;
Hanno Becker06811ce2017-05-03 15:10:34 +0100915#else
916 /* Temporary holding the blinded exponent (if used). */
917 mbedtls_mpi D_blind;
918
919 /* Pointer to actual exponent to be used - either the unblinded
920 * or the blinded one, depending on the presence of a PRNG. */
921 mbedtls_mpi *D = &ctx->D;
Hanno Becker43f94722017-08-25 11:50:00 +0100922#endif /* MBEDTLS_RSA_NO_CRT */
Hanno Becker06811ce2017-05-03 15:10:34 +0100923
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100924 /* Temporaries holding the initial input and the double
925 * checked result; should be the same in the end. */
926 mbedtls_mpi I, C;
Paul Bakker5121ce52009-01-03 21:22:43 +0000927
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500928 RSA_VALIDATE_RET( ctx != NULL );
929 RSA_VALIDATE_RET( input != NULL );
930 RSA_VALIDATE_RET( output != NULL );
931
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200932 if( f_rng == NULL )
933 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
934
935 if( rsa_check_context( ctx, 1 /* private key checks */,
936 1 /* blinding on */ ) != 0 )
Hanno Beckerebd2c022017-10-12 10:54:53 +0100937 {
Manuel Pégourié-Gonnardfb84d382015-10-30 10:56:25 +0100938 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Hanno Beckerebd2c022017-10-12 10:54:53 +0100939 }
Manuel Pégourié-Gonnardfb84d382015-10-30 10:56:25 +0100940
Hanno Becker06811ce2017-05-03 15:10:34 +0100941#if defined(MBEDTLS_THREADING_C)
942 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
943 return( ret );
944#endif
Janos Follathf9203b42017-03-22 15:13:15 +0000945
Hanno Becker06811ce2017-05-03 15:10:34 +0100946 /* MPI Initialization */
Hanno Becker06811ce2017-05-03 15:10:34 +0100947 mbedtls_mpi_init( &T );
948
949 mbedtls_mpi_init( &P1 );
950 mbedtls_mpi_init( &Q1 );
951 mbedtls_mpi_init( &R );
Janos Follathf9203b42017-03-22 15:13:15 +0000952
Janos Follathe81102e2017-03-22 13:38:28 +0000953#if defined(MBEDTLS_RSA_NO_CRT)
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200954 mbedtls_mpi_init( &D_blind );
Janos Follathf9203b42017-03-22 15:13:15 +0000955#else
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200956 mbedtls_mpi_init( &DP_blind );
957 mbedtls_mpi_init( &DQ_blind );
Janos Follathe81102e2017-03-22 13:38:28 +0000958#endif
959
Hanno Becker06811ce2017-05-03 15:10:34 +0100960#if !defined(MBEDTLS_RSA_NO_CRT)
961 mbedtls_mpi_init( &TP ); mbedtls_mpi_init( &TQ );
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +0200962#endif
963
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100964 mbedtls_mpi_init( &I );
965 mbedtls_mpi_init( &C );
Hanno Becker06811ce2017-05-03 15:10:34 +0100966
967 /* End of MPI initialization */
968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
970 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000971 {
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +0200972 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
973 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +0000974 }
975
Hanno Beckerc6075cc2017-08-25 11:45:35 +0100976 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &I, &T ) );
Hanno Becker06811ce2017-05-03 15:10:34 +0100977
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200978 /*
979 * Blinding
980 * T = T * Vi mod N
981 */
982 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
983 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
984 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Janos Follathe81102e2017-03-22 13:38:28 +0000985
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200986 /*
987 * Exponent blinding
988 */
989 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
990 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
Janos Follathe81102e2017-03-22 13:38:28 +0000991
Janos Follathf9203b42017-03-22 15:13:15 +0000992#if defined(MBEDTLS_RSA_NO_CRT)
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +0200993 /*
994 * D_blind = ( P - 1 ) * ( Q - 1 ) * R + D
995 */
996 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
997 f_rng, p_rng ) );
998 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &P1, &Q1 ) );
999 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &D_blind, &D_blind, &R ) );
1000 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &D_blind, &D_blind, &ctx->D ) );
Janos Follathe81102e2017-03-22 13:38:28 +00001001
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001002 D = &D_blind;
Janos Follathf9203b42017-03-22 15:13:15 +00001003#else
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001004 /*
1005 * DP_blind = ( P - 1 ) * R + DP
1006 */
1007 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
1008 f_rng, p_rng ) );
1009 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DP_blind, &P1, &R ) );
1010 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DP_blind, &DP_blind,
1011 &ctx->DP ) );
Janos Follathf9203b42017-03-22 15:13:15 +00001012
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001013 DP = &DP_blind;
Janos Follathf9203b42017-03-22 15:13:15 +00001014
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001015 /*
1016 * DQ_blind = ( Q - 1 ) * R + DQ
1017 */
1018 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &R, RSA_EXPONENT_BLINDING,
1019 f_rng, p_rng ) );
1020 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DQ_blind, &Q1, &R ) );
1021 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &DQ_blind, &DQ_blind,
1022 &ctx->DQ ) );
Janos Follathf9203b42017-03-22 15:13:15 +00001023
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001024 DQ = &DQ_blind;
Janos Follathe81102e2017-03-22 13:38:28 +00001025#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkeraab30c12013-08-30 11:00:25 +02001026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001027#if defined(MBEDTLS_RSA_NO_CRT)
Janos Follathe81102e2017-03-22 13:38:28 +00001028 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, D, &ctx->N, &ctx->RN ) );
Manuel Pégourié-Gonnarde10e06d2014-11-06 18:15:12 +01001029#else
Paul Bakkeraab30c12013-08-30 11:00:25 +02001030 /*
Janos Follathe81102e2017-03-22 13:38:28 +00001031 * Faster decryption using the CRT
Paul Bakker5121ce52009-01-03 21:22:43 +00001032 *
Hanno Becker06811ce2017-05-03 15:10:34 +01001033 * TP = input ^ dP mod P
1034 * TQ = input ^ dQ mod Q
Paul Bakker5121ce52009-01-03 21:22:43 +00001035 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001036
1037 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &TP, &T, DP, &ctx->P, &ctx->RP ) );
1038 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &TQ, &T, DQ, &ctx->Q, &ctx->RQ ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001039
1040 /*
Hanno Becker06811ce2017-05-03 15:10:34 +01001041 * T = (TP - TQ) * (Q^-1 mod P) mod P
Paul Bakker5121ce52009-01-03 21:22:43 +00001042 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001043 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &TP, &TQ ) );
1044 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &TP, &T, &ctx->QP ) );
1045 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &TP, &ctx->P ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001046
1047 /*
Hanno Becker06811ce2017-05-03 15:10:34 +01001048 * T = TQ + T * Q
Paul Bakker5121ce52009-01-03 21:22:43 +00001049 */
Hanno Becker06811ce2017-05-03 15:10:34 +01001050 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &TP, &T, &ctx->Q ) );
1051 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &TQ, &TP ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001052#endif /* MBEDTLS_RSA_NO_CRT */
Paul Bakkeraab30c12013-08-30 11:00:25 +02001053
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001054 /*
1055 * Unblind
1056 * T = T * Vf mod N
1057 */
1058 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
1059 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001060
Hanno Becker2dec5e82017-10-03 07:49:52 +01001061 /* Verify the result to prevent glitching attacks. */
1062 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &C, &T, &ctx->E,
1063 &ctx->N, &ctx->RN ) );
Hanno Beckerc6075cc2017-08-25 11:45:35 +01001064 if( mbedtls_mpi_cmp_mpi( &C, &I ) != 0 )
Hanno Becker06811ce2017-05-03 15:10:34 +01001065 {
Hanno Becker06811ce2017-05-03 15:10:34 +01001066 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
1067 goto cleanup;
1068 }
Hanno Becker06811ce2017-05-03 15:10:34 +01001069
Paul Bakker5121ce52009-01-03 21:22:43 +00001070 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001072
1073cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074#if defined(MBEDTLS_THREADING_C)
Manuel Pégourié-Gonnard4d04cdc2015-08-28 10:32:21 +02001075 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
1076 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
Manuel Pégourié-Gonnardae102992013-10-04 17:07:12 +02001077#endif
Manuel Pégourié-Gonnard1385a282015-08-27 11:30:58 +02001078
Hanno Becker06811ce2017-05-03 15:10:34 +01001079 mbedtls_mpi_free( &P1 );
1080 mbedtls_mpi_free( &Q1 );
1081 mbedtls_mpi_free( &R );
Janos Follathf9203b42017-03-22 15:13:15 +00001082
Janos Follathe81102e2017-03-22 13:38:28 +00001083#if defined(MBEDTLS_RSA_NO_CRT)
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001084 mbedtls_mpi_free( &D_blind );
Janos Follathf9203b42017-03-22 15:13:15 +00001085#else
Manuel Pégourié-Gonnardf0359042021-06-15 11:29:26 +02001086 mbedtls_mpi_free( &DP_blind );
1087 mbedtls_mpi_free( &DQ_blind );
Janos Follathe81102e2017-03-22 13:38:28 +00001088#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001089
Hanno Becker06811ce2017-05-03 15:10:34 +01001090 mbedtls_mpi_free( &T );
1091
1092#if !defined(MBEDTLS_RSA_NO_CRT)
1093 mbedtls_mpi_free( &TP ); mbedtls_mpi_free( &TQ );
1094#endif
1095
Hanno Beckerc6075cc2017-08-25 11:45:35 +01001096 mbedtls_mpi_free( &C );
1097 mbedtls_mpi_free( &I );
Hanno Becker06811ce2017-05-03 15:10:34 +01001098
Gilles Peskineae3741e2020-11-25 00:10:31 +01001099 if( ret != 0 && ret >= -0x007f )
Chris Jonesb7d02e02021-04-01 17:40:03 +01001100 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PRIVATE_FAILED, ret ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001101
Gilles Peskineae3741e2020-11-25 00:10:31 +01001102 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001103}
1104
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker9dcc3222011-03-08 14:16:06 +00001106/**
1107 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
1108 *
Paul Bakkerb125ed82011-11-10 13:33:51 +00001109 * \param dst buffer to mask
1110 * \param dlen length of destination buffer
1111 * \param src source of the mask generation
1112 * \param slen length of the source buffer
1113 * \param md_ctx message digest context to use
Paul Bakker9dcc3222011-03-08 14:16:06 +00001114 */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001115static int mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 size_t slen, mbedtls_md_context_t *md_ctx )
Paul Bakker9dcc3222011-03-08 14:16:06 +00001117{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001118 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +00001119 unsigned char counter[4];
1120 unsigned char *p;
Paul Bakker23986e52011-04-24 08:57:21 +00001121 unsigned int hlen;
1122 size_t i, use_len;
Andres Amaya Garcia94682d12017-07-20 14:26:37 +01001123 int ret = 0;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001124
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001125 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001126 memset( counter, 0, 4 );
1127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001128 hlen = mbedtls_md_get_size( md_ctx->md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001129
Simon Butcher02037452016-03-01 21:19:12 +00001130 /* Generate and apply dbMask */
Paul Bakker9dcc3222011-03-08 14:16:06 +00001131 p = dst;
1132
1133 while( dlen > 0 )
1134 {
1135 use_len = hlen;
1136 if( dlen < hlen )
1137 use_len = dlen;
1138
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001139 if( ( ret = mbedtls_md_starts( md_ctx ) ) != 0 )
1140 goto exit;
1141 if( ( ret = mbedtls_md_update( md_ctx, src, slen ) ) != 0 )
1142 goto exit;
1143 if( ( ret = mbedtls_md_update( md_ctx, counter, 4 ) ) != 0 )
1144 goto exit;
1145 if( ( ret = mbedtls_md_finish( md_ctx, mask ) ) != 0 )
1146 goto exit;
Paul Bakker9dcc3222011-03-08 14:16:06 +00001147
1148 for( i = 0; i < use_len; ++i )
1149 *p++ ^= mask[i];
1150
1151 counter[3]++;
1152
1153 dlen -= use_len;
1154 }
Gilles Peskine18ac7162017-05-05 19:24:06 +02001155
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001156exit:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001157 mbedtls_platform_zeroize( mask, sizeof( mask ) );
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001158
1159 return( ret );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001160}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001161#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker9dcc3222011-03-08 14:16:06 +00001162
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001163#if defined(MBEDTLS_PKCS1_V21)
Paul Bakkerb3869132013-02-28 17:21:01 +01001164/*
1165 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
1166 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001168 int (*f_rng)(void *, unsigned char *, size_t),
1169 void *p_rng,
Paul Bakkera43231c2013-02-28 17:33:49 +01001170 const unsigned char *label, size_t label_len,
1171 size_t ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001172 const unsigned char *input,
1173 unsigned char *output )
1174{
1175 size_t olen;
Janos Follath24eed8d2019-11-22 13:21:35 +00001176 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001177 unsigned char *p = output;
1178 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001179 const mbedtls_md_info_t *md_info;
1180 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001181
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001182 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001183 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001184 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001185 RSA_VALIDATE_RET( label_len == 0 || label != NULL );
1186
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001187 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001190 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001191 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001193
1194 olen = ctx->len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001196
Simon Butcher02037452016-03-01 21:19:12 +00001197 /* first comparison checks for overflow */
Janos Follatheddfe8f2016-02-08 14:52:29 +00001198 if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001200
1201 memset( output, 0, olen );
1202
1203 *p++ = 0;
1204
Simon Butcher02037452016-03-01 21:19:12 +00001205 /* Generate a random octet string seed */
Paul Bakkerb3869132013-02-28 17:21:01 +01001206 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +01001207 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001208
1209 p += hlen;
1210
Simon Butcher02037452016-03-01 21:19:12 +00001211 /* Construct DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001212 if( ( ret = mbedtls_md( md_info, label, label_len, p ) ) != 0 )
1213 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001214 p += hlen;
1215 p += olen - 2 * hlen - 2 - ilen;
1216 *p++ = 1;
Gilles Peskine004f87b2018-07-06 15:47:54 +02001217 if( ilen != 0 )
1218 memcpy( p, input, ilen );
Paul Bakkerb3869132013-02-28 17:21:01 +01001219
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001221 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001222 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001223
Simon Butcher02037452016-03-01 21:19:12 +00001224 /* maskedDB: Apply dbMask to DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001225 if( ( ret = mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
1226 &md_ctx ) ) != 0 )
1227 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001228
Simon Butcher02037452016-03-01 21:19:12 +00001229 /* maskedSeed: Apply seedMask to seed */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001230 if( ( ret = mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
1231 &md_ctx ) ) != 0 )
1232 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001233
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001234exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001235 mbedtls_md_free( &md_ctx );
Paul Bakkerb3869132013-02-28 17:21:01 +01001236
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001237 if( ret != 0 )
1238 return( ret );
1239
Thomas Daubney141700f2021-05-13 19:06:10 +01001240 return( mbedtls_rsa_public( ctx, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001241}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001242#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001244#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001245/*
1246 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
1247 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001248int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001249 int (*f_rng)(void *, unsigned char *, size_t),
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001250 void *p_rng, size_t ilen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001251 const unsigned char *input,
1252 unsigned char *output )
1253{
1254 size_t nb_pad, olen;
Janos Follath24eed8d2019-11-22 13:21:35 +00001255 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001256 unsigned char *p = output;
1257
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001258 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001259 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001260 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001261
Paul Bakkerb3869132013-02-28 17:21:01 +01001262 olen = ctx->len;
Manuel Pégourié-Gonnard370717b2016-02-11 10:35:13 +01001263
Simon Butcher02037452016-03-01 21:19:12 +00001264 /* first comparison checks for overflow */
Janos Follatheddfe8f2016-02-08 14:52:29 +00001265 if( ilen + 11 < ilen || olen < ilen + 11 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001266 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001267
1268 nb_pad = olen - 3 - ilen;
1269
1270 *p++ = 0;
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001271
1272 if( f_rng == NULL )
1273 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1274
1275 *p++ = MBEDTLS_RSA_CRYPT;
1276
1277 while( nb_pad-- > 0 )
Paul Bakkerb3869132013-02-28 17:21:01 +01001278 {
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001279 int rng_dl = 100;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001280
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001281 do {
1282 ret = f_rng( p_rng, p, 1 );
1283 } while( *p == 0 && --rng_dl && ret == 0 );
Paul Bakkerb3869132013-02-28 17:21:01 +01001284
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001285 /* Check if RNG failed to generate data */
1286 if( rng_dl == 0 || ret != 0 )
1287 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001288
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001289 p++;
Paul Bakkerb3869132013-02-28 17:21:01 +01001290 }
1291
1292 *p++ = 0;
Gilles Peskine004f87b2018-07-06 15:47:54 +02001293 if( ilen != 0 )
1294 memcpy( p, input, ilen );
Paul Bakkerb3869132013-02-28 17:21:01 +01001295
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001296 return( mbedtls_rsa_public( ctx, output, output ) );
Paul Bakkerb3869132013-02-28 17:21:01 +01001297}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001298#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001299
Paul Bakker5121ce52009-01-03 21:22:43 +00001300/*
1301 * Add the message padding, then do an RSA operation
1302 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001303int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001304 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker21eb2802010-08-16 11:10:02 +00001305 void *p_rng,
Thomas Daubney21772772021-05-13 17:30:32 +01001306 size_t ilen,
Paul Bakkerff60ee62010-03-16 21:09:09 +00001307 const unsigned char *input,
Paul Bakker5121ce52009-01-03 21:22:43 +00001308 unsigned char *output )
1309{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001310 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001311 RSA_VALIDATE_RET( output != NULL );
Jaeden Amerofb236732019-02-08 13:11:59 +00001312 RSA_VALIDATE_RET( ilen == 0 || input != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001313
Paul Bakker5121ce52009-01-03 21:22:43 +00001314 switch( ctx->padding )
1315 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001316#if defined(MBEDTLS_PKCS1_V15)
1317 case MBEDTLS_RSA_PKCS_V15:
Thomas Daubney21772772021-05-13 17:30:32 +01001318 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng,
Thomas Daubney53e4ac62021-05-13 18:26:49 +01001319 ilen, input, output );
Paul Bakker48377d92013-08-30 12:06:24 +02001320#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001321
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001322#if defined(MBEDTLS_PKCS1_V21)
1323 case MBEDTLS_RSA_PKCS_V21:
Thomas Daubney141700f2021-05-13 19:06:10 +01001324 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, NULL, 0,
Thomas Daubney21772772021-05-13 17:30:32 +01001325 ilen, input, output );
Paul Bakker9dcc3222011-03-08 14:16:06 +00001326#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001327
1328 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001329 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +00001330 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001331}
1332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001333#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +00001334/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001335 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
Paul Bakker5121ce52009-01-03 21:22:43 +00001336 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001337int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001338 int (*f_rng)(void *, unsigned char *, size_t),
1339 void *p_rng,
Paul Bakkera43231c2013-02-28 17:33:49 +01001340 const unsigned char *label, size_t label_len,
1341 size_t *olen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001342 const unsigned char *input,
1343 unsigned char *output,
1344 size_t output_max_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00001345{
Janos Follath24eed8d2019-11-22 13:21:35 +00001346 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001347 size_t ilen, i, pad_len;
1348 unsigned char *p, bad, pad_done;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
1350 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
Paul Bakker23986e52011-04-24 08:57:21 +00001351 unsigned int hlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001352 const mbedtls_md_info_t *md_info;
1353 mbedtls_md_context_t md_ctx;
Paul Bakkerb3869132013-02-28 17:21:01 +01001354
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001355 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001356 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1357 RSA_VALIDATE_RET( label_len == 0 || label != NULL );
1358 RSA_VALIDATE_RET( input != NULL );
1359 RSA_VALIDATE_RET( olen != NULL );
1360
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001361 /*
1362 * Parameters sanity checks
1363 */
Thomas Daubneyd21e0b72021-05-06 11:41:09 +01001364 if( ctx->padding != MBEDTLS_RSA_PKCS_V21 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001365 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00001366
1367 ilen = ctx->len;
1368
Paul Bakker27fdf462011-06-09 13:55:13 +00001369 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001370 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00001371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001372 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001373 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001374 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001375
Janos Follathc17cda12016-02-11 11:08:18 +00001376 hlen = mbedtls_md_get_size( md_info );
1377
1378 // checking for integer underflow
1379 if( 2 * hlen + 2 > ilen )
1380 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1381
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001382 /*
1383 * RSA operation
1384 */
Thomas Daubneyd21e0b72021-05-06 11:41:09 +01001385 ret = mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00001386
1387 if( ret != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001388 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00001389
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001390 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001391 * Unmask data and generate lHash
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001392 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001393 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001394 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
1395 {
1396 mbedtls_md_free( &md_ctx );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001397 goto cleanup;
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001398 }
1399
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001400 /* seed: Apply seedMask to maskedSeed */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001401 if( ( ret = mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
1402 &md_ctx ) ) != 0 ||
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001403 /* DB: Apply dbMask to maskedDB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001404 ( ret = mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
1405 &md_ctx ) ) != 0 )
1406 {
1407 mbedtls_md_free( &md_ctx );
1408 goto cleanup;
1409 }
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001411 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001412
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001413 /* Generate lHash */
1414 if( ( ret = mbedtls_md( md_info, label, label_len, lhash ) ) != 0 )
1415 goto cleanup;
1416
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001417 /*
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001418 * Check contents, in "constant-time"
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001419 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001420 p = buf;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001421 bad = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001422
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001423 bad |= *p++; /* First byte must be 0 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001424
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001425 p += hlen; /* Skip seed */
Paul Bakkerb3869132013-02-28 17:21:01 +01001426
Manuel Pégourié-Gonnarda5cfc352013-11-28 15:57:52 +01001427 /* Check lHash */
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001428 for( i = 0; i < hlen; i++ )
1429 bad |= lhash[i] ^ *p++;
Paul Bakkerb3869132013-02-28 17:21:01 +01001430
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001431 /* Get zero-padding len, but always read till end of buffer
1432 * (minus one, for the 01 byte) */
1433 pad_len = 0;
1434 pad_done = 0;
1435 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
1436 {
1437 pad_done |= p[i];
Pascal Junodb99183d2015-03-11 16:49:45 +01001438 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001439 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001440
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001441 p += pad_len;
1442 bad |= *p++ ^ 0x01;
Paul Bakkerb3869132013-02-28 17:21:01 +01001443
Manuel Pégourié-Gonnardab44d7e2013-11-29 12:49:44 +01001444 /*
1445 * The only information "leaked" is whether the padding was correct or not
1446 * (eg, no data is copied if it was not correct). This meets the
1447 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
1448 * the different error conditions.
1449 */
1450 if( bad != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001451 {
1452 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
1453 goto cleanup;
1454 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001455
Paul Bakker66d5d072014-06-17 16:39:18 +02001456 if( ilen - ( p - buf ) > output_max_len )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001457 {
1458 ret = MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE;
1459 goto cleanup;
1460 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001461
1462 *olen = ilen - (p - buf);
Gilles Peskine004f87b2018-07-06 15:47:54 +02001463 if( *olen != 0 )
1464 memcpy( output, p, *olen );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001465 ret = 0;
Paul Bakkerb3869132013-02-28 17:21:01 +01001466
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001467cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001468 mbedtls_platform_zeroize( buf, sizeof( buf ) );
1469 mbedtls_platform_zeroize( lhash, sizeof( lhash ) );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001470
1471 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01001472}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001473#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001474
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001475#if defined(MBEDTLS_PKCS1_V15)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001476/** Turn zero-or-nonzero into zero-or-all-bits-one, without branches.
1477 *
1478 * \param value The value to analyze.
1479 * \return Zero if \p value is zero, otherwise all-bits-one.
1480 */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001481static unsigned mbedtls_cf_uint_mask( unsigned value )
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001482{
1483 /* MSVC has a warning about unary minus on unsigned, but this is
1484 * well-defined and precisely what we want to do here */
1485#if defined(_MSC_VER)
1486#pragma warning( push )
1487#pragma warning( disable : 4146 )
1488#endif
1489 return( - ( ( value | - value ) >> ( sizeof( value ) * 8 - 1 ) ) );
1490#if defined(_MSC_VER)
1491#pragma warning( pop )
1492#endif
1493}
1494
1495/** Check whether a size is out of bounds, without branches.
1496 *
1497 * This is equivalent to `size > max`, but is likely to be compiled to
1498 * to code using bitwise operation rather than a branch.
1499 *
1500 * \param size Size to check.
1501 * \param max Maximum desired value for \p size.
1502 * \return \c 0 if `size <= max`.
1503 * \return \c 1 if `size > max`.
1504 */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001505static unsigned mbedtls_cf_size_gt( size_t size, size_t max )
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001506{
1507 /* Return the sign bit (1 for negative) of (max - size). */
1508 return( ( max - size ) >> ( sizeof( size_t ) * 8 - 1 ) );
1509}
1510
1511/** Choose between two integer values, without branches.
1512 *
1513 * This is equivalent to `cond ? if1 : if0`, but is likely to be compiled
1514 * to code using bitwise operation rather than a branch.
1515 *
1516 * \param cond Condition to test.
1517 * \param if1 Value to use if \p cond is nonzero.
1518 * \param if0 Value to use if \p cond is zero.
1519 * \return \c if1 if \p cond is nonzero, otherwise \c if0.
1520 */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001521static unsigned mbedtls_cf_uint_if( unsigned cond, unsigned if1, unsigned if0 )
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001522{
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001523 unsigned mask = mbedtls_cf_uint_mask( cond );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001524 return( ( mask & if1 ) | (~mask & if0 ) );
1525}
1526
1527/** Shift some data towards the left inside a buffer without leaking
1528 * the length of the data through side channels.
1529 *
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001530 * `mbedtls_cf_mem_move_to_left(start, total, offset)` is functionally
1531 * equivalent to
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001532 * ```
1533 * memmove(start, start + offset, total - offset);
1534 * memset(start + offset, 0, total - offset);
1535 * ```
1536 * but it strives to use a memory access pattern (and thus total timing)
1537 * that does not depend on \p offset. This timing independence comes at
1538 * the expense of performance.
1539 *
1540 * \param start Pointer to the start of the buffer.
1541 * \param total Total size of the buffer.
1542 * \param offset Offset from which to copy \p total - \p offset bytes.
1543 */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001544static void mbedtls_cf_mem_move_to_left( void *start,
1545 size_t total,
1546 size_t offset )
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001547{
1548 volatile unsigned char *buf = start;
1549 size_t i, n;
1550 if( total == 0 )
1551 return;
1552 for( i = 0; i < total; i++ )
1553 {
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001554 unsigned no_op = mbedtls_cf_size_gt( total - offset, i );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001555 /* The first `total - offset` passes are a no-op. The last
1556 * `offset` passes shift the data one byte to the left and
1557 * zero out the last byte. */
1558 for( n = 0; n < total - 1; n++ )
1559 {
1560 unsigned char current = buf[n];
1561 unsigned char next = buf[n+1];
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001562 buf[n] = mbedtls_cf_uint_if( no_op, current, next );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001563 }
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001564 buf[total-1] = mbedtls_cf_uint_if( no_op, buf[total-1], 0 );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001565 }
1566}
1567
Paul Bakkerb3869132013-02-28 17:21:01 +01001568/*
1569 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
1570 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001571int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001572 int (*f_rng)(void *, unsigned char *, size_t),
1573 void *p_rng,
Thomas Daubney34733082021-05-12 09:24:29 +01001574 size_t *olen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001575 const unsigned char *input,
1576 unsigned char *output,
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001577 size_t output_max_len )
Paul Bakkerb3869132013-02-28 17:21:01 +01001578{
Janos Follath24eed8d2019-11-22 13:21:35 +00001579 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001580 size_t ilen, i, plaintext_max_size;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001581 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001582 /* The following variables take sensitive values: their value must
1583 * not leak into the observable behavior of the function other than
1584 * the designated outputs (output, olen, return value). Otherwise
1585 * this would open the execution of the function to
1586 * side-channel-based variants of the Bleichenbacher padding oracle
1587 * attack. Potential side channels include overall timing, memory
1588 * access patterns (especially visible to an adversary who has access
1589 * to a shared memory cache), and branches (especially visible to
1590 * an adversary who has access to a shared code cache or to a shared
1591 * branch predictor). */
1592 size_t pad_count = 0;
1593 unsigned bad = 0;
1594 unsigned char pad_done = 0;
1595 size_t plaintext_size = 0;
1596 unsigned output_too_large;
1597
1598 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001599 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1600 RSA_VALIDATE_RET( input != NULL );
1601 RSA_VALIDATE_RET( olen != NULL );
1602
1603 ilen = ctx->len;
1604 plaintext_max_size = ( output_max_len > ilen - 11 ?
1605 ilen - 11 :
1606 output_max_len );
Paul Bakkerb3869132013-02-28 17:21:01 +01001607
Thomas Daubney34733082021-05-12 09:24:29 +01001608 if( ctx->padding != MBEDTLS_RSA_PKCS_V15 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001609 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001610
Paul Bakkerb3869132013-02-28 17:21:01 +01001611 if( ilen < 16 || ilen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001612 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001613
Thomas Daubney34733082021-05-12 09:24:29 +01001614 ret = mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
Paul Bakkerb3869132013-02-28 17:21:01 +01001615
1616 if( ret != 0 )
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001617 goto cleanup;
Paul Bakkerb3869132013-02-28 17:21:01 +01001618
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001619 /* Check and get padding length in constant time and constant
1620 * memory trace. The first byte must be 0. */
1621 bad |= buf[0];
Paul Bakkerb3869132013-02-28 17:21:01 +01001622
Paul Bakker5121ce52009-01-03 21:22:43 +00001623
Thomas Daubney34733082021-05-12 09:24:29 +01001624 /* Decode EME-PKCS1-v1_5 padding: 0x00 || 0x02 || PS || 0x00
1625 * where PS must be at least 8 nonzero bytes. */
1626 bad |= buf[1] ^ MBEDTLS_RSA_CRYPT;
Paul Bakkerb3869132013-02-28 17:21:01 +01001627
Thomas Daubney34733082021-05-12 09:24:29 +01001628 /* Read the whole buffer. Set pad_done to nonzero if we find
1629 * the 0x00 byte and remember the padding length in pad_count. */
1630 for( i = 2; i < ilen; i++ )
1631 {
1632 pad_done |= ((buf[i] | (unsigned char)-buf[i]) >> 7) ^ 1;
1633 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
Paul Bakker5121ce52009-01-03 21:22:43 +00001634 }
1635
Thomas Daubney34733082021-05-12 09:24:29 +01001636
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001637 /* If pad_done is still zero, there's no data, only unfinished padding. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001638 bad |= mbedtls_cf_uint_if( pad_done, 0, 1 );
Janos Follathb6eb1ca2016-02-08 13:59:25 +00001639
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001640 /* There must be at least 8 bytes of padding. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001641 bad |= mbedtls_cf_size_gt( 8, pad_count );
Paul Bakker8804f692013-02-28 18:06:26 +01001642
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001643 /* If the padding is valid, set plaintext_size to the number of
1644 * remaining bytes after stripping the padding. If the padding
1645 * is invalid, avoid leaking this fact through the size of the
1646 * output: use the maximum message size that fits in the output
1647 * buffer. Do it without branches to avoid leaking the padding
1648 * validity through timing. RSA keys are small enough that all the
1649 * size_t values involved fit in unsigned int. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001650 plaintext_size = mbedtls_cf_uint_if(
1651 bad, (unsigned) plaintext_max_size,
1652 (unsigned) ( ilen - pad_count - 3 ) );
Paul Bakker060c5682009-01-12 21:48:39 +00001653
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001654 /* Set output_too_large to 0 if the plaintext fits in the output
1655 * buffer and to 1 otherwise. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001656 output_too_large = mbedtls_cf_size_gt( plaintext_size,
1657 plaintext_max_size );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001658
1659 /* Set ret without branches to avoid timing attacks. Return:
1660 * - INVALID_PADDING if the padding is bad (bad != 0).
1661 * - OUTPUT_TOO_LARGE if the padding is good but the decrypted
1662 * plaintext does not fit in the output buffer.
1663 * - 0 if the padding is correct. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001664 ret = - (int) mbedtls_cf_uint_if(
1665 bad, - MBEDTLS_ERR_RSA_INVALID_PADDING,
1666 mbedtls_cf_uint_if( output_too_large,
1667 - MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE,
1668 0 ) );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001669
1670 /* If the padding is bad or the plaintext is too large, zero the
1671 * data that we're about to copy to the output buffer.
1672 * We need to copy the same amount of data
1673 * from the same buffer whether the padding is good or not to
1674 * avoid leaking the padding validity through overall timing or
1675 * through memory or cache access patterns. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001676 bad = mbedtls_cf_uint_mask( bad | output_too_large );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001677 for( i = 11; i < ilen; i++ )
1678 buf[i] &= ~bad;
1679
1680 /* If the plaintext is too large, truncate it to the buffer size.
1681 * Copy anyway to avoid revealing the length through timing, because
1682 * revealing the length is as bad as revealing the padding validity
1683 * for a Bleichenbacher attack. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001684 plaintext_size = mbedtls_cf_uint_if( output_too_large,
1685 (unsigned) plaintext_max_size,
1686 (unsigned) plaintext_size );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001687
1688 /* Move the plaintext to the leftmost position where it can start in
1689 * the working buffer, i.e. make it start plaintext_max_size from
1690 * the end of the buffer. Do this with a memory access trace that
1691 * does not depend on the plaintext size. After this move, the
1692 * starting location of the plaintext is no longer sensitive
1693 * information. */
gabor-mezei-arm9fa43ce2021-09-28 16:14:47 +02001694 mbedtls_cf_mem_move_to_left( buf + ilen - plaintext_max_size,
1695 plaintext_max_size,
1696 plaintext_max_size - plaintext_size );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001697
Jaeden Amero6f7703d2019-02-06 10:44:56 +00001698 /* Finally copy the decrypted plaintext plus trailing zeros into the output
1699 * buffer. If output_max_len is 0, then output may be an invalid pointer
1700 * and the result of memcpy() would be undefined; prevent undefined
1701 * behavior making sure to depend only on output_max_len (the size of the
1702 * user-provided output buffer), which is independent from plaintext
1703 * length, validity of padding, success of the decryption, and other
1704 * secrets. */
1705 if( output_max_len != 0 )
1706 memcpy( output, buf + ilen - plaintext_max_size, plaintext_max_size );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001707
1708 /* Report the amount of data we copied to the output buffer. In case
1709 * of errors (bad padding or output too large), the value of *olen
1710 * when this function returns is not specified. Making it equivalent
1711 * to the good case limits the risks of leaking the padding validity. */
1712 *olen = plaintext_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001713
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001714cleanup:
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001715 mbedtls_platform_zeroize( buf, sizeof( buf ) );
Gilles Peskine4a7f6a02017-03-23 14:37:37 +01001716
1717 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001718}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001719#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001720
1721/*
Paul Bakkerb3869132013-02-28 17:21:01 +01001722 * Do an RSA operation, then remove the message padding
1723 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001724int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02001725 int (*f_rng)(void *, unsigned char *, size_t),
1726 void *p_rng,
Thomas Daubneyc7feaf32021-05-07 14:02:43 +01001727 size_t *olen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001728 const unsigned char *input,
1729 unsigned char *output,
1730 size_t output_max_len)
1731{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001732 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001733 RSA_VALIDATE_RET( output_max_len == 0 || output != NULL );
1734 RSA_VALIDATE_RET( input != NULL );
1735 RSA_VALIDATE_RET( olen != NULL );
1736
Paul Bakkerb3869132013-02-28 17:21:01 +01001737 switch( ctx->padding )
1738 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001739#if defined(MBEDTLS_PKCS1_V15)
1740 case MBEDTLS_RSA_PKCS_V15:
Thomas Daubney34733082021-05-12 09:24:29 +01001741 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, olen,
Paul Bakker548957d2013-08-30 10:30:02 +02001742 input, output, output_max_len );
Paul Bakker48377d92013-08-30 12:06:24 +02001743#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01001744
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001745#if defined(MBEDTLS_PKCS1_V21)
1746 case MBEDTLS_RSA_PKCS_V21:
Thomas Daubneyd21e0b72021-05-06 11:41:09 +01001747 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, NULL, 0,
Paul Bakker548957d2013-08-30 10:30:02 +02001748 olen, input, output,
1749 output_max_len );
Paul Bakkerb3869132013-02-28 17:21:01 +01001750#endif
1751
1752 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001753 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01001754 }
1755}
1756
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001757#if defined(MBEDTLS_PKCS1_V21)
Cédric Meuterf3fab332020-04-25 11:30:45 +02001758static int rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
Paul Bakkerb3869132013-02-28 17:21:01 +01001759 int (*f_rng)(void *, unsigned char *, size_t),
1760 void *p_rng,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01001762 unsigned int hashlen,
1763 const unsigned char *hash,
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001764 int saltlen,
Paul Bakkerb3869132013-02-28 17:21:01 +01001765 unsigned char *sig )
1766{
1767 size_t olen;
1768 unsigned char *p = sig;
Cédric Meuter668a78d2020-04-30 11:57:04 +02001769 unsigned char *salt = NULL;
Jaeden Amero3725bb22018-09-07 19:12:36 +01001770 size_t slen, min_slen, hlen, offset = 0;
Janos Follath24eed8d2019-11-22 13:21:35 +00001771 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01001772 size_t msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773 const mbedtls_md_info_t *md_info;
1774 mbedtls_md_context_t md_ctx;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001775 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001776 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
1777 hashlen == 0 ) ||
1778 hash != NULL );
1779 RSA_VALIDATE_RET( sig != NULL );
Paul Bakkerb3869132013-02-28 17:21:01 +01001780
Thomas Daubneyd58ed582021-05-21 11:50:39 +01001781 if( ctx->padding != MBEDTLS_RSA_PKCS_V21 )
1782 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1783
Manuel Pégourié-Gonnarde6d1d822014-06-02 16:47:02 +02001784 if( f_rng == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001785 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001786
1787 olen = ctx->len;
1788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001789 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakkerb3869132013-02-28 17:21:01 +01001790 {
Simon Butcher02037452016-03-01 21:19:12 +00001791 /* Gather length of hash to sign */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001792 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001793 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001794 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02001795
Gilles Peskine6e3187b2021-06-22 18:39:53 +02001796 if( hashlen != mbedtls_md_get_size( md_info ) )
1797 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001798 }
1799
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001800 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01001801 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001802 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01001803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001804 hlen = mbedtls_md_get_size( md_info );
Paul Bakkerb3869132013-02-28 17:21:01 +01001805
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001806 if (saltlen == MBEDTLS_RSA_SALT_LEN_ANY)
1807 {
Cédric Meuter010ddc22020-04-25 09:24:11 +02001808 /* Calculate the largest possible salt length, up to the hash size.
1809 * Normally this is the hash length, which is the maximum salt length
1810 * according to FIPS 185-4 §5.5 (e) and common practice. If there is not
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001811 * enough room, use the maximum salt length that fits. The constraint is
1812 * that the hash length plus the salt length plus 2 bytes must be at most
1813 * the key length. This complies with FIPS 186-4 §5.5 (e) and RFC 8017
1814 * (PKCS#1 v2.2) §9.1.1 step 3. */
1815 min_slen = hlen - 2;
1816 if( olen < hlen + min_slen + 2 )
1817 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1818 else if( olen >= hlen + hlen + 2 )
1819 slen = hlen;
1820 else
1821 slen = olen - hlen - 2;
1822 }
Cédric Meuter46bad332021-01-10 12:57:19 +01001823 else if ( (saltlen < 0) || (saltlen + hlen + 2 > olen) )
Cédric Meuter010ddc22020-04-25 09:24:11 +02001824 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001825 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Cédric Meuter010ddc22020-04-25 09:24:11 +02001826 }
Jaeden Amero3725bb22018-09-07 19:12:36 +01001827 else
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001828 {
Cédric Meuter010ddc22020-04-25 09:24:11 +02001829 slen = (size_t) saltlen;
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001830 }
Paul Bakkerb3869132013-02-28 17:21:01 +01001831
1832 memset( sig, 0, olen );
1833
Simon Butcher02037452016-03-01 21:19:12 +00001834 /* Note: EMSA-PSS encoding is over the length of N - 1 bits */
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001835 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Jaeden Amero3725bb22018-09-07 19:12:36 +01001836 p += olen - hlen - slen - 2;
Paul Bakkerb3869132013-02-28 17:21:01 +01001837 *p++ = 0x01;
Cédric Meuter668a78d2020-04-30 11:57:04 +02001838
1839 /* Generate salt of length slen in place in the encoded message */
1840 salt = p;
1841 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
Chris Jonesb7d02e02021-04-01 17:40:03 +01001842 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
Cédric Meuter668a78d2020-04-30 11:57:04 +02001843
Paul Bakkerb3869132013-02-28 17:21:01 +01001844 p += slen;
1845
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001846 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07001847 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001848 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001849
Simon Butcher02037452016-03-01 21:19:12 +00001850 /* Generate H = Hash( M' ) */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001851 if( ( ret = mbedtls_md_starts( &md_ctx ) ) != 0 )
1852 goto exit;
1853 if( ( ret = mbedtls_md_update( &md_ctx, p, 8 ) ) != 0 )
1854 goto exit;
1855 if( ( ret = mbedtls_md_update( &md_ctx, hash, hashlen ) ) != 0 )
1856 goto exit;
1857 if( ( ret = mbedtls_md_update( &md_ctx, salt, slen ) ) != 0 )
1858 goto exit;
1859 if( ( ret = mbedtls_md_finish( &md_ctx, p ) ) != 0 )
1860 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001861
Simon Butcher02037452016-03-01 21:19:12 +00001862 /* Compensate for boundary condition when applying mask */
Paul Bakkerb3869132013-02-28 17:21:01 +01001863 if( msb % 8 == 0 )
1864 offset = 1;
1865
Simon Butcher02037452016-03-01 21:19:12 +00001866 /* maskedDB: Apply dbMask to DB */
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001867 if( ( ret = mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen,
1868 &md_ctx ) ) != 0 )
1869 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01001870
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001871 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakkerb3869132013-02-28 17:21:01 +01001872 sig[0] &= 0xFF >> ( olen * 8 - msb );
1873
1874 p += hlen;
1875 *p++ = 0xBC;
1876
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01001877exit:
1878 mbedtls_md_free( &md_ctx );
1879
1880 if( ret != 0 )
1881 return( ret );
1882
Thomas Daubneycad59ed2021-05-19 15:04:08 +01001883 return mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig );
Paul Bakkerb3869132013-02-28 17:21:01 +01001884}
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001885
1886/*
Cédric Meuterf3fab332020-04-25 11:30:45 +02001887 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function with
1888 * the option to pass in the salt length.
1889 */
1890int mbedtls_rsa_rsassa_pss_sign_ext( mbedtls_rsa_context *ctx,
1891 int (*f_rng)(void *, unsigned char *, size_t),
1892 void *p_rng,
1893 mbedtls_md_type_t md_alg,
1894 unsigned int hashlen,
1895 const unsigned char *hash,
1896 int saltlen,
1897 unsigned char *sig )
1898{
Thomas Daubneycad59ed2021-05-19 15:04:08 +01001899 return rsa_rsassa_pss_sign( ctx, f_rng, p_rng, md_alg,
Cédric Meuterf3fab332020-04-25 11:30:45 +02001900 hashlen, hash, saltlen, sig );
1901}
1902
1903
1904/*
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001905 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
1906 */
1907int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
1908 int (*f_rng)(void *, unsigned char *, size_t),
1909 void *p_rng,
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001910 mbedtls_md_type_t md_alg,
1911 unsigned int hashlen,
1912 const unsigned char *hash,
1913 unsigned char *sig )
1914{
Thomas Daubneycad59ed2021-05-19 15:04:08 +01001915 return rsa_rsassa_pss_sign( ctx, f_rng, p_rng, md_alg,
Cédric Meuterf3fab332020-04-25 11:30:45 +02001916 hashlen, hash, MBEDTLS_RSA_SALT_LEN_ANY, sig );
Cedric Meuter8aa4d752020-04-21 12:49:11 +02001917}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001918#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakkerb3869132013-02-28 17:21:01 +01001919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001920#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01001921/*
1922 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
1923 */
Hanno Beckerfdf38032017-09-06 12:35:55 +01001924
1925/* Construct a PKCS v1.5 encoding of a hashed message
1926 *
1927 * This is used both for signature generation and verification.
1928 *
1929 * Parameters:
1930 * - md_alg: Identifies the hash algorithm used to generate the given hash;
Hanno Beckere58d38c2017-09-27 17:09:00 +01001931 * MBEDTLS_MD_NONE if raw data is signed.
Gilles Peskine6e3187b2021-06-22 18:39:53 +02001932 * - hashlen: Length of hash. Must match md_alg if that's not NONE.
Hanno Beckere58d38c2017-09-27 17:09:00 +01001933 * - hash: Buffer containing the hashed message or the raw data.
1934 * - dst_len: Length of the encoded message.
Hanno Beckerfdf38032017-09-06 12:35:55 +01001935 * - dst: Buffer to hold the encoded message.
1936 *
1937 * Assumptions:
Gilles Peskine6e3187b2021-06-22 18:39:53 +02001938 * - hash has size hashlen.
Hanno Beckere58d38c2017-09-27 17:09:00 +01001939 * - dst points to a buffer of size at least dst_len.
Hanno Beckerfdf38032017-09-06 12:35:55 +01001940 *
1941 */
1942static int rsa_rsassa_pkcs1_v15_encode( mbedtls_md_type_t md_alg,
1943 unsigned int hashlen,
1944 const unsigned char *hash,
Hanno Beckere58d38c2017-09-27 17:09:00 +01001945 size_t dst_len,
Hanno Beckerfdf38032017-09-06 12:35:55 +01001946 unsigned char *dst )
1947{
1948 size_t oid_size = 0;
Hanno Beckere58d38c2017-09-27 17:09:00 +01001949 size_t nb_pad = dst_len;
Hanno Beckerfdf38032017-09-06 12:35:55 +01001950 unsigned char *p = dst;
1951 const char *oid = NULL;
1952
1953 /* Are we signing hashed or raw data? */
1954 if( md_alg != MBEDTLS_MD_NONE )
1955 {
1956 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
1957 if( md_info == NULL )
1958 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1959
1960 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
1961 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1962
Gilles Peskine6e3187b2021-06-22 18:39:53 +02001963 if( hashlen != mbedtls_md_get_size( md_info ) )
1964 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Hanno Beckerfdf38032017-09-06 12:35:55 +01001965
1966 /* Double-check that 8 + hashlen + oid_size can be used as a
1967 * 1-byte ASN.1 length encoding and that there's no overflow. */
1968 if( 8 + hashlen + oid_size >= 0x80 ||
1969 10 + hashlen < hashlen ||
1970 10 + hashlen + oid_size < 10 + hashlen )
1971 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1972
1973 /*
1974 * Static bounds check:
1975 * - Need 10 bytes for five tag-length pairs.
1976 * (Insist on 1-byte length encodings to protect against variants of
1977 * Bleichenbacher's forgery attack against lax PKCS#1v1.5 verification)
1978 * - Need hashlen bytes for hash
1979 * - Need oid_size bytes for hash alg OID.
1980 */
1981 if( nb_pad < 10 + hashlen + oid_size )
1982 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1983 nb_pad -= 10 + hashlen + oid_size;
1984 }
1985 else
1986 {
1987 if( nb_pad < hashlen )
1988 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1989
1990 nb_pad -= hashlen;
1991 }
1992
Hanno Becker2b2f8982017-09-27 17:10:03 +01001993 /* Need space for signature header and padding delimiter (3 bytes),
1994 * and 8 bytes for the minimal padding */
1995 if( nb_pad < 3 + 8 )
Hanno Beckerfdf38032017-09-06 12:35:55 +01001996 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
1997 nb_pad -= 3;
1998
1999 /* Now nb_pad is the amount of memory to be filled
Hanno Becker2b2f8982017-09-27 17:10:03 +01002000 * with padding, and at least 8 bytes long. */
Hanno Beckerfdf38032017-09-06 12:35:55 +01002001
2002 /* Write signature header and padding */
2003 *p++ = 0;
2004 *p++ = MBEDTLS_RSA_SIGN;
2005 memset( p, 0xFF, nb_pad );
2006 p += nb_pad;
2007 *p++ = 0;
2008
2009 /* Are we signing raw data? */
2010 if( md_alg == MBEDTLS_MD_NONE )
2011 {
2012 memcpy( p, hash, hashlen );
2013 return( 0 );
2014 }
2015
2016 /* Signing hashed data, add corresponding ASN.1 structure
2017 *
2018 * DigestInfo ::= SEQUENCE {
2019 * digestAlgorithm DigestAlgorithmIdentifier,
2020 * digest Digest }
2021 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
2022 * Digest ::= OCTET STRING
2023 *
2024 * Schematic:
2025 * TAG-SEQ + LEN [ TAG-SEQ + LEN [ TAG-OID + LEN [ OID ]
2026 * TAG-NULL + LEN [ NULL ] ]
2027 * TAG-OCTET + LEN [ HASH ] ]
2028 */
2029 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Hanno Becker87ae1972018-01-15 15:27:56 +00002030 *p++ = (unsigned char)( 0x08 + oid_size + hashlen );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002031 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
Hanno Becker87ae1972018-01-15 15:27:56 +00002032 *p++ = (unsigned char)( 0x04 + oid_size );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002033 *p++ = MBEDTLS_ASN1_OID;
Hanno Becker87ae1972018-01-15 15:27:56 +00002034 *p++ = (unsigned char) oid_size;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002035 memcpy( p, oid, oid_size );
2036 p += oid_size;
2037 *p++ = MBEDTLS_ASN1_NULL;
2038 *p++ = 0x00;
2039 *p++ = MBEDTLS_ASN1_OCTET_STRING;
Hanno Becker87ae1972018-01-15 15:27:56 +00002040 *p++ = (unsigned char) hashlen;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002041 memcpy( p, hash, hashlen );
2042 p += hashlen;
2043
2044 /* Just a sanity-check, should be automatic
2045 * after the initial bounds check. */
Hanno Beckere58d38c2017-09-27 17:09:00 +01002046 if( p != dst + dst_len )
Hanno Beckerfdf38032017-09-06 12:35:55 +01002047 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002048 mbedtls_platform_zeroize( dst, dst_len );
Hanno Beckerfdf38032017-09-06 12:35:55 +01002049 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2050 }
2051
2052 return( 0 );
2053}
2054
Paul Bakkerb3869132013-02-28 17:21:01 +01002055/*
2056 * Do an RSA operation to sign the message digest
2057 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002058int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
Paul Bakker548957d2013-08-30 10:30:02 +02002059 int (*f_rng)(void *, unsigned char *, size_t),
2060 void *p_rng,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002061 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002062 unsigned int hashlen,
2063 const unsigned char *hash,
2064 unsigned char *sig )
2065{
Janos Follath24eed8d2019-11-22 13:21:35 +00002066 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerfdf38032017-09-06 12:35:55 +01002067 unsigned char *sig_try = NULL, *verif = NULL;
Paul Bakkerb3869132013-02-28 17:21:01 +01002068
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002069 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002070 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2071 hashlen == 0 ) ||
2072 hash != NULL );
2073 RSA_VALIDATE_RET( sig != NULL );
2074
Thomas Daubneyd58ed582021-05-21 11:50:39 +01002075 if( ctx->padding != MBEDTLS_RSA_PKCS_V15 )
2076 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2077
Hanno Beckerfdf38032017-09-06 12:35:55 +01002078 /*
2079 * Prepare PKCS1-v1.5 encoding (padding and hash identifier)
2080 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002081
Hanno Beckerfdf38032017-09-06 12:35:55 +01002082 if( ( ret = rsa_rsassa_pkcs1_v15_encode( md_alg, hashlen, hash,
2083 ctx->len, sig ) ) != 0 )
2084 return( ret );
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002085
Hanno Beckerfdf38032017-09-06 12:35:55 +01002086 /* Private key operation
2087 *
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002088 * In order to prevent Lenstra's attack, make the signature in a
2089 * temporary buffer and check it before returning it.
2090 */
Hanno Beckerfdf38032017-09-06 12:35:55 +01002091
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002092 sig_try = mbedtls_calloc( 1, ctx->len );
Simon Butcher1285ab52016-01-01 21:42:47 +00002093 if( sig_try == NULL )
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002094 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
2095
Hanno Beckerfdf38032017-09-06 12:35:55 +01002096 verif = mbedtls_calloc( 1, ctx->len );
Simon Butcher1285ab52016-01-01 21:42:47 +00002097 if( verif == NULL )
2098 {
2099 mbedtls_free( sig_try );
2100 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
2101 }
2102
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002103 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
2104 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
2105
Hanno Becker171a8f12017-09-06 12:32:16 +01002106 if( mbedtls_safer_memcmp( verif, sig, ctx->len ) != 0 )
Manuel Pégourié-Gonnard5f501042015-09-03 20:03:15 +02002107 {
2108 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
2109 goto cleanup;
2110 }
2111
2112 memcpy( sig, sig_try, ctx->len );
2113
2114cleanup:
2115 mbedtls_free( sig_try );
2116 mbedtls_free( verif );
2117
2118 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01002119}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002120#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002121
2122/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002123 * Do an RSA operation to sign the message digest
2124 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002125int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
Paul Bakkera3d195c2011-11-27 21:07:34 +00002126 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker9dcc3222011-03-08 14:16:06 +00002127 void *p_rng,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002128 mbedtls_md_type_t md_alg,
Paul Bakker23986e52011-04-24 08:57:21 +00002129 unsigned int hashlen,
Paul Bakkerff60ee62010-03-16 21:09:09 +00002130 const unsigned char *hash,
Paul Bakker5121ce52009-01-03 21:22:43 +00002131 unsigned char *sig )
2132{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002133 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002134 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2135 hashlen == 0 ) ||
2136 hash != NULL );
2137 RSA_VALIDATE_RET( sig != NULL );
2138
Paul Bakker5121ce52009-01-03 21:22:43 +00002139 switch( ctx->padding )
2140 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002141#if defined(MBEDTLS_PKCS1_V15)
2142 case MBEDTLS_RSA_PKCS_V15:
Thomas Daubney52654982021-05-18 16:54:00 +01002143 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng,
Thomas Daubney140184d2021-05-18 16:04:07 +01002144 md_alg, hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02002145#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002147#if defined(MBEDTLS_PKCS1_V21)
2148 case MBEDTLS_RSA_PKCS_V21:
Thomas Daubneyde9fdc42021-05-18 17:10:04 +01002149 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, md_alg,
2150 hashlen, hash, sig );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002151#endif
2152
Paul Bakker5121ce52009-01-03 21:22:43 +00002153 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002154 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakker5121ce52009-01-03 21:22:43 +00002155 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002156}
2157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002158#if defined(MBEDTLS_PKCS1_V21)
Paul Bakker5121ce52009-01-03 21:22:43 +00002159/*
Paul Bakkerb3869132013-02-28 17:21:01 +01002160 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
Paul Bakker5121ce52009-01-03 21:22:43 +00002161 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002162int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002163 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002164 unsigned int hashlen,
2165 const unsigned char *hash,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002166 mbedtls_md_type_t mgf1_hash_id,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002167 int expected_salt_len,
2168 const unsigned char *sig )
Paul Bakker5121ce52009-01-03 21:22:43 +00002169{
Janos Follath24eed8d2019-11-22 13:21:35 +00002170 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb3869132013-02-28 17:21:01 +01002171 size_t siglen;
2172 unsigned char *p;
Gilles Peskine6a54b022017-10-17 19:02:13 +02002173 unsigned char *hash_start;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002174 unsigned char result[MBEDTLS_MD_MAX_SIZE];
Paul Bakker9dcc3222011-03-08 14:16:06 +00002175 unsigned char zeros[8];
Paul Bakker23986e52011-04-24 08:57:21 +00002176 unsigned int hlen;
Gilles Peskine6a54b022017-10-17 19:02:13 +02002177 size_t observed_salt_len, msb;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002178 const mbedtls_md_info_t *md_info;
2179 mbedtls_md_context_t md_ctx;
Nicholas Wilson409401c2016-04-13 11:48:25 +01002180 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
Paul Bakkerb3869132013-02-28 17:21:01 +01002181
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002182 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002183 RSA_VALIDATE_RET( sig != NULL );
2184 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2185 hashlen == 0 ) ||
2186 hash != NULL );
2187
Paul Bakker5121ce52009-01-03 21:22:43 +00002188 siglen = ctx->len;
2189
Paul Bakker27fdf462011-06-09 13:55:13 +00002190 if( siglen < 16 || siglen > sizeof( buf ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002191 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00002192
Thomas Daubney782a7f52021-05-19 12:27:35 +01002193 ret = mbedtls_rsa_public( ctx, sig, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00002194
2195 if( ret != 0 )
2196 return( ret );
2197
2198 p = buf;
2199
Paul Bakkerb3869132013-02-28 17:21:01 +01002200 if( buf[siglen - 1] != 0xBC )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002201 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01002202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002203 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002204 {
Simon Butcher02037452016-03-01 21:19:12 +00002205 /* Gather length of hash to sign */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206 md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002207 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002208 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002209
Gilles Peskine6e3187b2021-06-22 18:39:53 +02002210 if( hashlen != mbedtls_md_get_size( md_info ) )
2211 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakkerb3869132013-02-28 17:21:01 +01002212 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002214 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
Paul Bakkerb3869132013-02-28 17:21:01 +01002215 if( md_info == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002216 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218 hlen = mbedtls_md_get_size( md_info );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002219
Paul Bakkerb3869132013-02-28 17:21:01 +01002220 memset( zeros, 0, 8 );
Paul Bakker53019ae2011-03-25 13:58:48 +00002221
Simon Butcher02037452016-03-01 21:19:12 +00002222 /*
2223 * Note: EMSA-PSS verification is over the length of N - 1 bits
2224 */
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02002225 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002226
Gilles Peskineb00b0da2017-10-19 15:23:49 +02002227 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
2228 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2229
Simon Butcher02037452016-03-01 21:19:12 +00002230 /* Compensate for boundary condition when applying mask */
Paul Bakkerb3869132013-02-28 17:21:01 +01002231 if( msb % 8 == 0 )
2232 {
2233 p++;
2234 siglen -= 1;
2235 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002236
Gilles Peskine139108a2017-10-18 19:03:42 +02002237 if( siglen < hlen + 2 )
2238 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
2239 hash_start = p + siglen - hlen - 1;
2240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002241 mbedtls_md_init( &md_ctx );
Brian J Murraye7be5bd2016-06-23 12:57:03 -07002242 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002243 goto exit;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002244
Jaeden Amero66954e12018-01-25 16:05:54 +00002245 ret = mgf_mask( p, siglen - hlen - 1, hash_start, hlen, &md_ctx );
2246 if( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002247 goto exit;
Paul Bakker02303e82013-01-03 11:08:31 +01002248
Paul Bakkerb3869132013-02-28 17:21:01 +01002249 buf[0] &= 0xFF >> ( siglen * 8 - msb );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002250
Gilles Peskine6a54b022017-10-17 19:02:13 +02002251 while( p < hash_start - 1 && *p == 0 )
Paul Bakkerb3869132013-02-28 17:21:01 +01002252 p++;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002253
Gilles Peskine91048a32017-10-19 17:46:14 +02002254 if( *p++ != 0x01 )
Paul Bakkerb3869132013-02-28 17:21:01 +01002255 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002256 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
2257 goto exit;
Paul Bakkerb3869132013-02-28 17:21:01 +01002258 }
Paul Bakker9dcc3222011-03-08 14:16:06 +00002259
Gilles Peskine6a54b022017-10-17 19:02:13 +02002260 observed_salt_len = hash_start - p;
Paul Bakker9dcc3222011-03-08 14:16:06 +00002261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002262 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
Gilles Peskine6a54b022017-10-17 19:02:13 +02002263 observed_salt_len != (size_t) expected_salt_len )
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002264 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002265 ret = MBEDTLS_ERR_RSA_INVALID_PADDING;
2266 goto exit;
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002267 }
2268
Simon Butcher02037452016-03-01 21:19:12 +00002269 /*
2270 * Generate H = Hash( M' )
2271 */
Jaeden Amero66954e12018-01-25 16:05:54 +00002272 ret = mbedtls_md_starts( &md_ctx );
2273 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002274 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002275 ret = mbedtls_md_update( &md_ctx, zeros, 8 );
2276 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002277 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002278 ret = mbedtls_md_update( &md_ctx, hash, hashlen );
2279 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002280 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002281 ret = mbedtls_md_update( &md_ctx, p, observed_salt_len );
2282 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002283 goto exit;
Jaeden Amero66954e12018-01-25 16:05:54 +00002284 ret = mbedtls_md_finish( &md_ctx, result );
2285 if ( ret != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002286 goto exit;
Paul Bakker53019ae2011-03-25 13:58:48 +00002287
Jaeden Amero66954e12018-01-25 16:05:54 +00002288 if( memcmp( hash_start, result, hlen ) != 0 )
Andres Amaya Garciac5c7d762017-07-20 14:42:16 +01002289 {
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002290 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
Andres Amaya Garciac5c7d762017-07-20 14:42:16 +01002291 goto exit;
2292 }
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002293
2294exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002295 mbedtls_md_free( &md_ctx );
Paul Bakker9dcc3222011-03-08 14:16:06 +00002296
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002297 return( ret );
Paul Bakkerb3869132013-02-28 17:21:01 +01002298}
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002299
2300/*
2301 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
2302 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002303int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002304 mbedtls_md_type_t md_alg,
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002305 unsigned int hashlen,
2306 const unsigned char *hash,
2307 const unsigned char *sig )
2308{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002309 mbedtls_md_type_t mgf1_hash_id;
2310 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002311 RSA_VALIDATE_RET( sig != NULL );
2312 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2313 hashlen == 0 ) ||
2314 hash != NULL );
2315
2316 mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002317 ? (mbedtls_md_type_t) ctx->hash_id
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002318 : md_alg;
2319
Thomas Daubney9e65f792021-05-19 12:18:58 +01002320 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx,
Thomas Daubney5ee4cc02021-05-19 12:07:42 +01002321 md_alg, hashlen, hash,
2322 mgf1_hash_id,
2323 MBEDTLS_RSA_SALT_LEN_ANY,
2324 sig ) );
Manuel Pégourié-Gonnard5ec628a2014-06-03 11:44:06 +02002325
2326}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002327#endif /* MBEDTLS_PKCS1_V21 */
Paul Bakker40628ba2013-01-03 10:50:31 +01002328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002329#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkerb3869132013-02-28 17:21:01 +01002330/*
2331 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
2332 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002334 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002335 unsigned int hashlen,
2336 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02002337 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01002338{
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002339 int ret = 0;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002340 size_t sig_len;
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002341 unsigned char *encoded = NULL, *encoded_expected = NULL;
Paul Bakkerb3869132013-02-28 17:21:01 +01002342
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002343 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002344 RSA_VALIDATE_RET( sig != NULL );
2345 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2346 hashlen == 0 ) ||
2347 hash != NULL );
2348
2349 sig_len = ctx->len;
2350
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002351 /*
2352 * Prepare expected PKCS1 v1.5 encoding of hash.
2353 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002354
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002355 if( ( encoded = mbedtls_calloc( 1, sig_len ) ) == NULL ||
2356 ( encoded_expected = mbedtls_calloc( 1, sig_len ) ) == NULL )
2357 {
2358 ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
2359 goto cleanup;
2360 }
2361
2362 if( ( ret = rsa_rsassa_pkcs1_v15_encode( md_alg, hashlen, hash, sig_len,
2363 encoded_expected ) ) != 0 )
2364 goto cleanup;
2365
2366 /*
2367 * Apply RSA primitive to get what should be PKCS1 encoded hash.
2368 */
Paul Bakkerb3869132013-02-28 17:21:01 +01002369
Thomas Daubney41e4ce42021-05-19 15:10:05 +01002370 ret = mbedtls_rsa_public( ctx, sig, encoded );
Paul Bakkerb3869132013-02-28 17:21:01 +01002371 if( ret != 0 )
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002372 goto cleanup;
Paul Bakkerc70b9822013-04-07 22:00:46 +02002373
Simon Butcher02037452016-03-01 21:19:12 +00002374 /*
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002375 * Compare
Simon Butcher02037452016-03-01 21:19:12 +00002376 */
Paul Bakkerc70b9822013-04-07 22:00:46 +02002377
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002378 if( ( ret = mbedtls_safer_memcmp( encoded, encoded_expected,
2379 sig_len ) ) != 0 )
2380 {
2381 ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
2382 goto cleanup;
2383 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002384
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002385cleanup:
Paul Bakkerc70b9822013-04-07 22:00:46 +02002386
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002387 if( encoded != NULL )
2388 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002389 mbedtls_platform_zeroize( encoded, sig_len );
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002390 mbedtls_free( encoded );
2391 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002392
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002393 if( encoded_expected != NULL )
2394 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002395 mbedtls_platform_zeroize( encoded_expected, sig_len );
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002396 mbedtls_free( encoded_expected );
2397 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002398
Hanno Becker64a8c0a2017-09-06 12:39:49 +01002399 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002400}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002401#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002402
2403/*
Paul Bakkerb3869132013-02-28 17:21:01 +01002404 * Do an RSA operation and check the message digest
2405 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002406int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002407 mbedtls_md_type_t md_alg,
Paul Bakkerb3869132013-02-28 17:21:01 +01002408 unsigned int hashlen,
2409 const unsigned char *hash,
Manuel Pégourié-Gonnardcc0a9d02013-08-12 11:34:35 +02002410 const unsigned char *sig )
Paul Bakkerb3869132013-02-28 17:21:01 +01002411{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002412 RSA_VALIDATE_RET( ctx != NULL );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002413 RSA_VALIDATE_RET( sig != NULL );
2414 RSA_VALIDATE_RET( ( md_alg == MBEDTLS_MD_NONE &&
2415 hashlen == 0 ) ||
2416 hash != NULL );
2417
Paul Bakkerb3869132013-02-28 17:21:01 +01002418 switch( ctx->padding )
2419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002420#if defined(MBEDTLS_PKCS1_V15)
2421 case MBEDTLS_RSA_PKCS_V15:
Thomas Daubney2e126252021-05-19 11:48:53 +01002422 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, md_alg,
2423 hashlen, hash, sig );
Paul Bakker48377d92013-08-30 12:06:24 +02002424#endif
Paul Bakkerb3869132013-02-28 17:21:01 +01002425
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002426#if defined(MBEDTLS_PKCS1_V21)
2427 case MBEDTLS_RSA_PKCS_V21:
Thomas Daubney5ee4cc02021-05-19 12:07:42 +01002428 return mbedtls_rsa_rsassa_pss_verify( ctx, md_alg,
2429 hashlen, hash, sig );
Paul Bakkerb3869132013-02-28 17:21:01 +01002430#endif
2431
2432 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002433 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
Paul Bakkerb3869132013-02-28 17:21:01 +01002434 }
2435}
2436
2437/*
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002438 * Copy the components of an RSA key
2439 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002440int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002441{
Janos Follath24eed8d2019-11-22 13:21:35 +00002442 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002443 RSA_VALIDATE_RET( dst != NULL );
2444 RSA_VALIDATE_RET( src != NULL );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002445
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002446 dst->len = src->len;
2447
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002448 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
2449 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002450
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
2452 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
2453 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
Hanno Becker33c30a02017-08-23 07:00:22 +01002454
2455#if !defined(MBEDTLS_RSA_NO_CRT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002456 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
2457 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
2458 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002459 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
2460 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
Hanno Becker33c30a02017-08-23 07:00:22 +01002461#endif
2462
2463 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002464
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002465 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
2466 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
Manuel Pégourié-Gonnardea53a552013-09-10 13:29:30 +02002467
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002468 dst->padding = src->padding;
Manuel Pégourié-Gonnardfdddac92014-03-25 15:58:35 +01002469 dst->hash_id = src->hash_id;
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002470
2471cleanup:
2472 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002473 mbedtls_rsa_free( dst );
Manuel Pégourié-Gonnard3053f5b2013-08-14 13:39:57 +02002474
2475 return( ret );
2476}
2477
2478/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002479 * Free the components of an RSA key
2480 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002481void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
Paul Bakker5121ce52009-01-03 21:22:43 +00002482{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002483 if( ctx == NULL )
2484 return;
2485
2486 mbedtls_mpi_free( &ctx->Vi );
2487 mbedtls_mpi_free( &ctx->Vf );
2488 mbedtls_mpi_free( &ctx->RN );
2489 mbedtls_mpi_free( &ctx->D );
2490 mbedtls_mpi_free( &ctx->Q );
2491 mbedtls_mpi_free( &ctx->P );
2492 mbedtls_mpi_free( &ctx->E );
2493 mbedtls_mpi_free( &ctx->N );
Paul Bakkerc9965dc2013-09-29 14:58:17 +02002494
Hanno Becker33c30a02017-08-23 07:00:22 +01002495#if !defined(MBEDTLS_RSA_NO_CRT)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002496 mbedtls_mpi_free( &ctx->RQ );
2497 mbedtls_mpi_free( &ctx->RP );
2498 mbedtls_mpi_free( &ctx->QP );
2499 mbedtls_mpi_free( &ctx->DQ );
Hanno Becker33c30a02017-08-23 07:00:22 +01002500 mbedtls_mpi_free( &ctx->DP );
2501#endif /* MBEDTLS_RSA_NO_CRT */
2502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002503#if defined(MBEDTLS_THREADING_C)
Gilles Peskineeb940592021-02-01 17:57:41 +01002504 /* Free the mutex, but only if it hasn't been freed already. */
2505 if( ctx->ver != 0 )
2506 {
2507 mbedtls_mutex_free( &ctx->mutex );
2508 ctx->ver = 0;
2509 }
Paul Bakkerc9965dc2013-09-29 14:58:17 +02002510#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002511}
2512
Hanno Beckerab377312017-08-23 16:24:51 +01002513#endif /* !MBEDTLS_RSA_ALT */
2514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002515#if defined(MBEDTLS_SELF_TEST)
Paul Bakker5121ce52009-01-03 21:22:43 +00002516
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +00002517#include "mbedtls/sha1.h"
Paul Bakker5121ce52009-01-03 21:22:43 +00002518
2519/*
2520 * Example RSA-1024 keypair, for test purposes
2521 */
2522#define KEY_LEN 128
2523
2524#define RSA_N "9292758453063D803DD603D5E777D788" \
2525 "8ED1D5BF35786190FA2F23EBC0848AEA" \
2526 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
2527 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
2528 "93A89813FBF3C4F8066D2D800F7C38A8" \
2529 "1AE31942917403FF4946B0A83D3D3E05" \
2530 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
2531 "5E94BB77B07507233A0BC7BAC8F90F79"
2532
2533#define RSA_E "10001"
2534
2535#define RSA_D "24BF6185468786FDD303083D25E64EFC" \
2536 "66CA472BC44D253102F8B4A9D3BFA750" \
2537 "91386C0077937FE33FA3252D28855837" \
2538 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
2539 "DF79C5CE07EE72C7F123142198164234" \
2540 "CABB724CF78B8173B9F880FC86322407" \
2541 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
2542 "071513A1E85B5DFA031F21ECAE91A34D"
2543
2544#define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
2545 "2C01CAD19EA484A87EA4377637E75500" \
2546 "FCB2005C5C7DD6EC4AC023CDA285D796" \
2547 "C3D9E75E1EFC42488BB4F1D13AC30A57"
2548
2549#define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
2550 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
2551 "910E4168387E3C30AA1E00C339A79508" \
2552 "8452DD96A9A5EA5D9DCA68DA636032AF"
2553
Paul Bakker5121ce52009-01-03 21:22:43 +00002554#define PT_LEN 24
2555#define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
2556 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
2557
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002558#if defined(MBEDTLS_PKCS1_V15)
Paul Bakkera3d195c2011-11-27 21:07:34 +00002559static int myrand( void *rng_state, unsigned char *output, size_t len )
Paul Bakker545570e2010-07-18 09:00:25 +00002560{
gufe44c2620da2020-08-03 17:56:50 +02002561#if !defined(__OpenBSD__) && !defined(__NetBSD__)
Paul Bakkera3d195c2011-11-27 21:07:34 +00002562 size_t i;
2563
Paul Bakker545570e2010-07-18 09:00:25 +00002564 if( rng_state != NULL )
2565 rng_state = NULL;
2566
Paul Bakkera3d195c2011-11-27 21:07:34 +00002567 for( i = 0; i < len; ++i )
2568 output[i] = rand();
Paul Bakkerf96f7b62014-04-30 16:02:38 +02002569#else
2570 if( rng_state != NULL )
2571 rng_state = NULL;
2572
2573 arc4random_buf( output, len );
gufe44c2620da2020-08-03 17:56:50 +02002574#endif /* !OpenBSD && !NetBSD */
Paul Bakker48377d92013-08-30 12:06:24 +02002575
Paul Bakkera3d195c2011-11-27 21:07:34 +00002576 return( 0 );
Paul Bakker545570e2010-07-18 09:00:25 +00002577}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002578#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker545570e2010-07-18 09:00:25 +00002579
Paul Bakker5121ce52009-01-03 21:22:43 +00002580/*
2581 * Checkup routine
2582 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002583int mbedtls_rsa_self_test( int verbose )
Paul Bakker5121ce52009-01-03 21:22:43 +00002584{
Paul Bakker3d8fb632014-04-17 12:42:41 +02002585 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002586#if defined(MBEDTLS_PKCS1_V15)
Paul Bakker23986e52011-04-24 08:57:21 +00002587 size_t len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002588 mbedtls_rsa_context rsa;
Paul Bakker5121ce52009-01-03 21:22:43 +00002589 unsigned char rsa_plaintext[PT_LEN];
2590 unsigned char rsa_decrypted[PT_LEN];
2591 unsigned char rsa_ciphertext[KEY_LEN];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002592#if defined(MBEDTLS_SHA1_C)
Paul Bakker5690efc2011-05-26 13:16:06 +00002593 unsigned char sha1sum[20];
2594#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002595
Hanno Becker3a701162017-08-22 13:52:43 +01002596 mbedtls_mpi K;
2597
2598 mbedtls_mpi_init( &K );
Ronald Cronc1905a12021-06-05 11:11:14 +02002599 mbedtls_rsa_init( &rsa );
Paul Bakker5121ce52009-01-03 21:22:43 +00002600
Hanno Becker3a701162017-08-22 13:52:43 +01002601 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_N ) );
2602 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, &K, NULL, NULL, NULL, NULL ) );
2603 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_P ) );
2604 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, &K, NULL, NULL, NULL ) );
2605 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_Q ) );
2606 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, &K, NULL, NULL ) );
2607 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_D ) );
2608 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, NULL, &K, NULL ) );
2609 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &K, 16, RSA_E ) );
2610 MBEDTLS_MPI_CHK( mbedtls_rsa_import( &rsa, NULL, NULL, NULL, NULL, &K ) );
2611
Hanno Becker7f25f852017-10-10 16:56:22 +01002612 MBEDTLS_MPI_CHK( mbedtls_rsa_complete( &rsa ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002613
2614 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002615 mbedtls_printf( " RSA key validation: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002617 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
2618 mbedtls_rsa_check_privkey( &rsa ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002619 {
2620 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002621 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002622
Hanno Becker5bc87292017-05-03 15:09:31 +01002623 ret = 1;
2624 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002625 }
2626
2627 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002628 mbedtls_printf( "passed\n PKCS#1 encryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002629
2630 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
2631
Thomas Daubney21772772021-05-13 17:30:32 +01002632 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL,
Hanno Becker98838b02017-10-02 13:16:10 +01002633 PT_LEN, rsa_plaintext,
2634 rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002635 {
2636 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002637 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002638
Hanno Becker5bc87292017-05-03 15:09:31 +01002639 ret = 1;
2640 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002641 }
2642
2643 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002644 mbedtls_printf( "passed\n PKCS#1 decryption : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002645
Thomas Daubneyc7feaf32021-05-07 14:02:43 +01002646 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL,
Hanno Becker98838b02017-10-02 13:16:10 +01002647 &len, rsa_ciphertext, rsa_decrypted,
2648 sizeof(rsa_decrypted) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002649 {
2650 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002651 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002652
Hanno Becker5bc87292017-05-03 15:09:31 +01002653 ret = 1;
2654 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002655 }
2656
2657 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
2658 {
2659 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002661
Hanno Becker5bc87292017-05-03 15:09:31 +01002662 ret = 1;
2663 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002664 }
2665
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002666 if( verbose != 0 )
2667 mbedtls_printf( "passed\n" );
2668
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002669#if defined(MBEDTLS_SHA1_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00002670 if( verbose != 0 )
Brian Murray930a3702016-05-18 14:38:02 -07002671 mbedtls_printf( " PKCS#1 data sign : " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002672
TRodziewicz26371e42021-06-08 16:45:41 +02002673 if( mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum ) != 0 )
Andres Amaya Garcia698089e2017-06-28 11:46:46 +01002674 {
2675 if( verbose != 0 )
2676 mbedtls_printf( "failed\n" );
2677
2678 return( 1 );
2679 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002680
Hanno Becker98838b02017-10-02 13:16:10 +01002681 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL,
Gilles Peskine6e3187b2021-06-22 18:39:53 +02002682 MBEDTLS_MD_SHA1, 20,
Hanno Becker98838b02017-10-02 13:16:10 +01002683 sha1sum, rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002684 {
2685 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002686 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002687
Hanno Becker5bc87292017-05-03 15:09:31 +01002688 ret = 1;
2689 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002690 }
2691
2692 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002693 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
Paul Bakker5121ce52009-01-03 21:22:43 +00002694
Gilles Peskine6e3187b2021-06-22 18:39:53 +02002695 if( mbedtls_rsa_pkcs1_verify( &rsa, MBEDTLS_MD_SHA1, 20,
Hanno Becker98838b02017-10-02 13:16:10 +01002696 sha1sum, rsa_ciphertext ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002697 {
2698 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002699 mbedtls_printf( "failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00002700
Hanno Becker5bc87292017-05-03 15:09:31 +01002701 ret = 1;
2702 goto cleanup;
Paul Bakker5121ce52009-01-03 21:22:43 +00002703 }
2704
2705 if( verbose != 0 )
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002706 mbedtls_printf( "passed\n" );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002707#endif /* MBEDTLS_SHA1_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002708
Manuel Pégourié-Gonnardd1004f02015-08-07 10:46:54 +02002709 if( verbose != 0 )
2710 mbedtls_printf( "\n" );
2711
Paul Bakker3d8fb632014-04-17 12:42:41 +02002712cleanup:
Hanno Becker3a701162017-08-22 13:52:43 +01002713 mbedtls_mpi_free( &K );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002714 mbedtls_rsa_free( &rsa );
2715#else /* MBEDTLS_PKCS1_V15 */
Paul Bakker3e41fe82013-09-15 17:42:50 +02002716 ((void) verbose);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002717#endif /* MBEDTLS_PKCS1_V15 */
Paul Bakker3d8fb632014-04-17 12:42:41 +02002718 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002719}
2720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002721#endif /* MBEDTLS_SELF_TEST */
Paul Bakker5121ce52009-01-03 21:22:43 +00002722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002723#endif /* MBEDTLS_RSA_C */