rsa.c File Reference

RSA public-key cryptography. More...

#include <byteswap.h>
#include <stdint.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <strings.h>
#include <errno.h>
#include <ipxe/asn1.h>
#include <ipxe/crypto.h>
#include <ipxe/bigint.h>
#include <ipxe/random_nz.h>
#include <ipxe/md5_sha1.h>
#include <ipxe/rsa.h>

Go to the source code of this file.

Data Structures
struct	rsa_context
	An RSA context. More...

Macros
#define	EACCES_VERIFY   __einfo_error ( EINFO_EACCES_VERIFY )
#define	EINFO_EACCES_VERIFY   __einfo_uniqify ( EINFO_EACCES, 0x01, "RSA signature incorrect" )

Typedefs
typedef int	rsa_encode_t(struct rsa_context *context, struct digest_algorithm *digest, const void *value, const void *reference, void *encoded)
	Encode digest.

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static struct rsa_digestinfo_prefix *	rsa_find_prefix (struct digest_algorithm *digest)
	Identify RSA prefix.
static void	rsa_free (struct rsa_context *context)
	Free RSA dynamic storage.
static int	rsa_alloc (struct rsa_context *context, size_t modulus_len, size_t exponent_len)
	Allocate RSA dynamic storage.
static int	rsa_parse_mod_exp (struct asn1_cursor *modulus, struct asn1_cursor *exponent, const struct asn1_cursor *raw)
	Parse RSA modulus and exponent.
static int	rsa_init (struct rsa_context *context, const struct asn1_cursor *key)
	Initialise RSA cipher.
static int	rsa_cipher (struct rsa_context *context, const void *in, void *out)
	Perform RSA cipher operation.
static int	rsa_pkcs1_encrypt (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *key, const struct asn1_cursor *plaintext, struct asn1_builder *ciphertext)
	Encrypt using RSA PKCS#1.
static int	rsa_pkcs1_decrypt (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *key, const struct asn1_cursor *ciphertext, struct asn1_builder *plaintext)
	Decrypt using RSA PKCS#1.
static int	rsa_pkcs1_encode (struct rsa_context *context, struct digest_algorithm *digest, const void *value, const void *reference __unused, void *encoded)
	Encode digest using RSA PKCS#1.
static void	rsa_xor_mask (struct digest_algorithm *digest, void *ctx, void *out, const void *seed, void *xor, size_t len)
	Apply RSA PSS mask generation function.
static int	rsa_pss_encode (struct rsa_context *context, struct digest_algorithm *digest, const void *value, const void *reference, void *encoded)
	Encode digest using RSA PSS.
static int	rsa_sign (struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, struct asn1_builder *signature)
	Sign digest value using RSA.
static int	rsa_verify (struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, const struct asn1_cursor *signature)
	Verify signed digest value using RSA.
static int	rsa_match (struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor *private_key, const struct asn1_cursor *public_key)
	Check for matching RSA public/private key pair.
	REQUIRING_SYMBOL (rsa_algorithm)
	REQUIRE_OBJECT (config_crypto)

Variables
int(*	rsa_get_random )(void *data, size_t len) = get_random_nz
	Generate random data.
struct pubkey_algorithm	rsa_algorithm
	RSA public-key algorithm.
struct pubkey_algorithm	rsa_pss_algorithm
	RSA-PSS public-key algorithm.

Detailed Description

RSA public-key cryptography.

RSA is documented in RFC 3447 and updated in RFC 8017.

Definition in file rsa.c.

Macro Definition Documentation

EACCES_VERIFY

#define EACCES_VERIFY   __einfo_error ( EINFO_EACCES_VERIFY )

Definition at line 49 of file rsa.c.

#define EACCES_VERIFY \
        __einfo_error ( EINFO_EACCES_VERIFY )

Referenced by rsa_verify().

EINFO_EACCES_VERIFY

#define EINFO_EACCES_VERIFY   __einfo_uniqify ( EINFO_EACCES, 0x01, "RSA signature incorrect" )

Definition at line 51 of file rsa.c.

#define EINFO_EACCES_VERIFY \
        __einfo_uniqify ( EINFO_EACCES, 0x01, "RSA signature incorrect" )

Typedef Documentation

rsa_encode_t

typedef int rsa_encode_t(struct rsa_context *context, struct digest_algorithm *digest, const void *value, const void *reference, void *encoded)

Encode digest.

Parameters

context	RSA context
digest	Digest algorithm
value	Digest value
reference	Reference encoded digest (or NULL)
encoded	Encoded digest

Return values

rc	Return status code

Definition at line 88 of file rsa.c.

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

FILE_SECBOOT()

FILE_SECBOOT

(

PERMITTED

)

rsa_find_prefix()

struct rsa_digestinfo_prefix * rsa_find_prefix ( struct digest_algorithm * digest )

static

Identify RSA prefix.

Parameters

digest

Digest algorithm

Return values

prefix

RSA prefix, or NULL

Definition at line 103 of file rsa.c.

                                                    {
        struct rsa_digestinfo_prefix *prefix;
 
        for_each_table_entry ( prefix, RSA_DIGESTINFO_PREFIXES ) {
                if ( prefix->digest == digest )
                        return prefix;
        }
        return NULL;
}

References rsa_digestinfo_prefix::digest, for_each_table_entry, NULL, prefix, and RSA_DIGESTINFO_PREFIXES.

Referenced by rsa_pkcs1_encode().

rsa_free()

void rsa_free ( struct rsa_context * context )

inlinestatic

Free RSA dynamic storage.

Parameters

context

RSA context

Definition at line 118 of file rsa.c.

                                                            {
 
        zfree ( context->dynamic );
}

References rsa_context::dynamic, and zfree().

Referenced by rsa_init(), rsa_pkcs1_decrypt(), rsa_pkcs1_encrypt(), rsa_sign(), and rsa_verify().

rsa_alloc()

int rsa_alloc ( struct rsa_context * context, size_t modulus_len, size_t exponent_len )

static

Allocate RSA dynamic storage.

Parameters

context	RSA context
modulus_len	Modulus length
exponent_len	Exponent length

Return values

rc	Return status code

Definition at line 131 of file rsa.c.

                                             {
        unsigned int size = bigint_required_size ( modulus_len );
        unsigned int exponent_size = bigint_required_size ( exponent_len );
        bigint_t ( size ) *modulus;
        size_t tmp_len = bigint_mod_exp_tmp_len ( modulus );
        struct {
                bigint_t ( size ) modulus;
                bigint_t ( exponent_size ) exponent;
                bigint_t ( size ) input;
                bigint_t ( size ) output;
                uint8_t tmp[tmp_len];
        } __attribute__ (( packed )) *dynamic;
 
        /* Allocate dynamic storage */
        dynamic = malloc ( sizeof ( *dynamic ) );
        if ( ! dynamic )
                return -ENOMEM;
 
        /* Assign dynamic storage */
        context->dynamic = dynamic;
        context->modulus0 = &dynamic->modulus.element[0];
        context->size = size;
        context->max_len = modulus_len;
        context->exponent0 = &dynamic->exponent.element[0];
        context->exponent_size = exponent_size;
        context->input0 = &dynamic->input.element[0];
        context->output0 = &dynamic->output.element[0];
        context->tmp = &dynamic->tmp;
 
        return 0;
}

References __attribute__, bigint_mod_exp_tmp_len, bigint_required_size, bigint_t, rsa_context::dynamic, ENOMEM, rsa_context::exponent0, rsa_context::exponent_size, rsa_context::input0, malloc(), rsa_context::max_len, rsa_context::modulus0, rsa_context::output0, rsa_context::size, size, rsa_context::tmp, and tmp.

Referenced by rsa_init().

rsa_parse_mod_exp()

int rsa_parse_mod_exp ( struct asn1_cursor * modulus, struct asn1_cursor * exponent, const struct asn1_cursor * raw )

static

Parse RSA modulus and exponent.

Parameters

modulus	Modulus to fill in
exponent	Exponent to fill in
raw	ASN.1 cursor

Return values

rc	Return status code

Definition at line 172 of file rsa.c.

                                                               {
        struct asn1_cursor cursor;
        int is_private;
        int rc;
 
        /* Enter subjectPublicKeyInfo/privateKeyInfo/RSAPrivateKey */
        memcpy ( &cursor, raw, sizeof ( cursor ) );
        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
        /* Determine key format */
        if ( asn1_type ( &cursor ) == ASN1_INTEGER ) {
 
                /* Private key */
                is_private = 1;
 
                /* Skip version */
                asn1_skip_any ( &cursor );
 
                /* Enter privateKey, if present */
                if ( asn1_check_algorithm ( &cursor, &rsa_encryption_algorithm,
                                            NULL ) == 0 ) {
 
                        /* Skip privateKeyAlgorithm */
                        asn1_skip_any ( &cursor );
 
                        /* Enter privateKey */
                        asn1_enter ( &cursor, ASN1_OCTET_STRING );
 
                        /* Enter RSAPrivateKey */
                        asn1_enter ( &cursor, ASN1_SEQUENCE );
 
                        /* Skip version */
                        asn1_skip ( &cursor, ASN1_INTEGER );
                }
 
        } else {
 
                /* Public key */
                is_private = 0;
 
                /* Skip algorithm */
                asn1_skip ( &cursor, ASN1_SEQUENCE );
 
                /* Enter subjectPublicKey */
                asn1_enter_bits ( &cursor, NULL );
 
                /* Enter RSAPublicKey */
                asn1_enter ( &cursor, ASN1_SEQUENCE );
        }
 
        /* Extract modulus */
        memcpy ( modulus, &cursor, sizeof ( *modulus ) );
        if ( ( rc = asn1_enter_unsigned ( modulus ) ) != 0 )
                return rc;
        asn1_skip_any ( &cursor );
 
        /* Skip public exponent, if applicable */
        if ( is_private )
                asn1_skip ( &cursor, ASN1_INTEGER );
 
        /* Extract publicExponent/privateExponent */
        memcpy ( exponent, &cursor, sizeof ( *exponent ) );
        if ( ( rc = asn1_enter_unsigned ( exponent ) ) != 0 )
                return rc;
 
        return 0;
}

References asn1_check_algorithm(), asn1_enter(), asn1_enter_bits(), asn1_enter_unsigned(), ASN1_INTEGER, ASN1_OCTET_STRING, ASN1_SEQUENCE, asn1_skip(), asn1_skip_any(), asn1_type(), memcpy(), NULL, raw, and rc.

Referenced by rsa_init(), and rsa_match().

rsa_init()

int rsa_init ( struct rsa_context * context, const struct asn1_cursor * key )

static

Initialise RSA cipher.

Parameters

context	RSA context
key	Key

Return values

rc	Return status code

Definition at line 249 of file rsa.c.

                                                      {
        struct asn1_cursor modulus;
        struct asn1_cursor exponent;
        uint8_t msb;
        int rc;
 
        /* Initialise context */
        memset ( context, 0, sizeof ( *context ) );
 
        /* Parse modulus and exponent */
        if ( ( rc = rsa_parse_mod_exp ( &modulus, &exponent, key ) ) != 0 ){
                DBGC ( context, "RSA %p invalid modulus/exponent:\n", context );
                DBGC_HDA ( context, 0, key->data, key->len );
                goto err_parse;
        }
 
        DBGC ( context, "RSA %p modulus:\n", context );
        DBGC_HDA ( context, 0, modulus.data, modulus.len );
        DBGC ( context, "RSA %p exponent:\n", context );
        DBGC_HDA ( context, 0, exponent.data, exponent.len );
 
        /* Construct MSB mask */
        msb = *( ( const uint8_t * ) modulus.data );
        if ( ! msb ) {
                DBGC ( context, "RSA %p invalid modulus MSB\n", context );
                rc = -EINVAL;
                goto err_msb;
        }
        context->mask = ( ( 1 << ( fls ( msb ) - 1 ) ) - 1 );
 
        /* Allocate dynamic storage */
        if ( ( rc = rsa_alloc ( context, modulus.len, exponent.len ) ) != 0 )
                goto err_alloc;
 
        /* Construct big integers */
        bigint_init ( ( ( bigint_t ( context->size ) * ) context->modulus0 ),
                      modulus.data, modulus.len );
        bigint_init ( ( ( bigint_t ( context->exponent_size ) * )
                        context->exponent0 ), exponent.data, exponent.len );
 
        return 0;
 
        rsa_free ( context );
 err_alloc:
 err_msb:
 err_parse:
        return rc;
}

References bigint_init, bigint_t, asn1_cursor::data, DBGC, DBGC_HDA, EINVAL, rsa_context::exponent0, rsa_context::exponent_size, fls, key, asn1_cursor::len, rsa_context::mask, memset(), rsa_context::modulus0, rc, rsa_alloc(), rsa_free(), rsa_parse_mod_exp(), and rsa_context::size.

Referenced by rsa_pkcs1_decrypt(), rsa_pkcs1_encrypt(), rsa_sign(), and rsa_verify().

rsa_cipher()

int rsa_cipher ( struct rsa_context * context, const void * in, void * out )

static

Perform RSA cipher operation.

Parameters

context	RSA context
in	Input buffer
out	Output buffer

Return values

canonical

Input was in canonical form

Definition at line 307 of file rsa.c.

                                                    {
        bigint_t ( context->size ) *input = ( ( void * ) context->input0 );
        bigint_t ( context->size ) *output = ( ( void * ) context->output0 );
        bigint_t ( context->size ) *modulus = ( ( void * ) context->modulus0 );
        bigint_t ( context->exponent_size ) *exponent =
                ( ( void * ) context->exponent0 );
        int canonical;
 
        /* Initialise big integer */
        bigint_init ( input, in, context->max_len );
        canonical = ( ! bigint_is_geq ( input, modulus ) );
 
        /* Perform modular exponentiation */
        bigint_mod_exp ( input, modulus, exponent, output, context->tmp );
 
        /* Copy out result */
        bigint_done ( output, out, context->max_len );
 
        /* Check for canonical input */
        return canonical;
}

References bigint_done, bigint_init, bigint_is_geq, bigint_mod_exp, bigint_t, rsa_context::exponent0, rsa_context::exponent_size, in, rsa_context::input0, rsa_context::max_len, rsa_context::modulus0, out, rsa_context::output0, rsa_context::size, and rsa_context::tmp.

Referenced by rsa_pkcs1_decrypt(), rsa_pkcs1_encrypt(), rsa_sign(), and rsa_verify().

rsa_pkcs1_encrypt()

int rsa_pkcs1_encrypt ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * key, const struct asn1_cursor * plaintext, struct asn1_builder * ciphertext )

static

Encrypt using RSA PKCS#1.

Parameters

pubkey	Public-key algorithm
key	Key
plaintext	Plaintext
ciphertext	Ciphertext

Return values

ciphertext_len

Length of ciphertext, or negative error

Definition at line 339 of file rsa.c.

                                                                 {
        struct rsa_context context;
        void *temp;
        uint8_t *encoded;
        size_t min_len;
        size_t pad_len;
        int canonical;
        int rc;
 
        DBGC ( &context, "RSA %p encrypting:\n", &context );
        DBGC_HDA ( &context, 0, plaintext->data, plaintext->len );
 
        /* Initialise context */
        if ( ( rc = rsa_init ( &context, key ) ) != 0 )
                goto err_init;
 
        /* Calculate lengths */
        min_len = ( 1 /* "0x00" */ + 1 /* "0x02" */ + 8 /* minimum padding */
                    + 1 /* "0x00" */ + plaintext->len );
        if ( min_len > context.max_len ) {
                DBGC ( &context, "RSA %p modulus too small for %zd-byte "
                       "plaintext\n", &context, plaintext->len );
                goto err_sanity;
        }
        pad_len = ( 8 /* minimum padding */ + context.max_len - min_len );
 
        /* Construct encoded message (using the big integer output
         * buffer as temporary storage)
         */
        temp = context.output0;
        encoded = temp;
        encoded[0] = 0x00;
        encoded[1] = 0x02;
        if ( ( rc = rsa_get_random ( &encoded[2], pad_len ) ) != 0 ) {
                DBGC ( &context, "RSA %p could not generate random data: %s\n",
                       &context, strerror ( rc ) );
                goto err_random;
        }
        encoded[ 2 + pad_len ] = 0x00;
        memcpy ( &encoded[ context.max_len - plaintext->len ],
                 plaintext->data, plaintext->len );
        DBGC ( &context, "RSA %p encoded:\n", &context );
        DBGC_HDA ( &context, 0, encoded, context.max_len );
 
        /* Create space for ciphertext */
        if ( ( rc = asn1_grow ( ciphertext, context.max_len ) ) != 0 )
                goto err_grow;
 
        /* Encipher the encoded message */
        canonical = rsa_cipher ( &context, encoded, ciphertext->data );
        assert ( canonical );
        DBGC ( &context, "RSA %p encrypted:\n", &context );
        DBGC_HDA ( &context, 0, ciphertext->data, context.max_len );
 
        /* Free context */
        rsa_free ( &context );
 
        return 0;
 
 err_grow:
 err_random:
 err_sanity:
        rsa_free ( &context );
 err_init:
        return rc;
}

References __unused, asn1_grow(), assert, asn1_builder::data, asn1_cursor::data, DBGC, DBGC_HDA, key, asn1_cursor::len, rsa_context::max_len, memcpy(), rsa_context::output0, rc, rsa_cipher(), rsa_free(), rsa_get_random, rsa_init(), and strerror().

rsa_pkcs1_decrypt()

int rsa_pkcs1_decrypt ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * key, const struct asn1_cursor * ciphertext, struct asn1_builder * plaintext )

static

Decrypt using RSA PKCS#1.

Parameters

pubkey	Public-key algorithm
key	Key
ciphertext	Ciphertext
plaintext	Plaintext

Return values

rc	Return status code

Definition at line 418 of file rsa.c.

                                                                {
        struct rsa_context context;
        void *temp;
        uint8_t *encoded;
        uint8_t *end;
        uint8_t *pad;
        uint8_t *zero;
        uint8_t *start;
        size_t len;
        int canonical;
        int rc;
 
        DBGC ( &context, "RSA %p decrypting:\n", &context );
        DBGC_HDA ( &context, 0, ciphertext->data, ciphertext->len );
 
        /* Initialise context */
        if ( ( rc = rsa_init ( &context, key ) ) != 0 )
                goto err_init;
 
        /* Sanity check */
        if ( ciphertext->len != context.max_len ) {
                DBGC ( &context, "RSA %p ciphertext incorrect length (%zd "
                       "bytes, should be %zd)\n",
                       &context, ciphertext->len, context.max_len );
                rc = -ERANGE;
                goto err_sanity;
        }
 
        /* Decipher the message (using the big integer input buffer as
         * temporary storage)
         */
        temp = context.input0;
        encoded = temp;
        canonical = rsa_cipher ( &context, ciphertext->data, encoded );
        DBGC ( &context, "RSA %p encoded:\n", &context );
        DBGC_HDA ( &context, 0, encoded, context.max_len );
        if ( ! canonical ) {
                DBGC ( &context, "RSA %p ciphertext was not canonical\n",
                       &context );
                rc = -EINVAL;
                goto err_canonical;
        }
 
        /* Parse the message */
        end = ( encoded + context.max_len );
        if ( ( encoded[0] != 0x00 ) || ( encoded[1] != 0x02 ) ) {
                rc = -EINVAL;
                goto err_invalid;
        }
        pad = &encoded[2];
        zero = memchr ( pad, 0, ( end - pad ) );
        if ( ( ! zero ) || ( ( zero - pad ) < 8 /* minimum padding */ ) ) {
                DBGC ( &context, "RSA %p invalid decrypted message:\n",
                       &context );
                DBGC_HDA ( &context, 0, encoded, context.max_len );
                rc = -EINVAL;
                goto err_invalid;
        }
        start = ( zero + 1 );
        len = ( end - start );
 
        /* Create space for plaintext */
        if ( ( rc = asn1_grow ( plaintext, len ) ) != 0 )
                goto err_grow;
 
        /* Copy out message */
        memcpy ( plaintext->data, start, len );
        DBGC ( &context, "RSA %p decrypted:\n", &context );
        DBGC_HDA ( &context, 0, plaintext->data, len );
 
        /* Free context */
        rsa_free ( &context );
 
        return 0;
 
 err_grow:
 err_invalid:
 err_canonical:
 err_sanity:
        rsa_free ( &context );
 err_init:
        return rc;
}

References __unused, asn1_grow(), asn1_builder::data, asn1_cursor::data, DBGC, DBGC_HDA, EINVAL, end, ERANGE, rsa_context::input0, key, asn1_cursor::len, len, rsa_context::max_len, memchr(), memcpy(), pad, rc, rsa_cipher(), rsa_free(), rsa_init(), and start.

rsa_pkcs1_encode()

int rsa_pkcs1_encode ( struct rsa_context * context, struct digest_algorithm * digest, const void * value, const void *reference __unused, void * encoded )

static

Encode digest using RSA PKCS#1.

Parameters

context	RSA context
digest	Digest algorithm
value	Digest value
reference	Reference encoded digest (or NULL)
encoded	Encoded digest

Return values

rc	Return status code

Definition at line 515 of file rsa.c.

                                              {
        struct rsa_digestinfo_prefix *prefix;
        size_t digest_len = digest->digestsize;
        uint8_t *temp = encoded;
        size_t digestinfo_len;
        size_t min_len;
        size_t pad_len;
 
        /* Identify prefix (if any) */
        prefix = rsa_find_prefix ( digest );
        if ( ( ! prefix ) && ( ! is_md5_sha1 ( digest ) ) ) {
                DBGC ( context, "RSA %p has no prefix for %s\n",
                       context, digest->name );
                return -ENOTSUP;
        }
 
        /* Calculate length */
        digestinfo_len = ( digest_len + ( prefix ? prefix->len : 0 ) );
 
        /* Sanity check */
        min_len = ( 1 /* "0x00" */ + 1 /* "0x01" */ + 8 /* minimum padding */
                    + 1 /* "0x00" */ + digestinfo_len );
        if ( min_len > context->max_len ) {
                DBGC ( context, "RSA %p modulus too small for %s digest\n",
                       context, digest->name );
                return -ERANGE;
        }
        DBGC ( context, "RSA %p encoding %s digest using PKCS#1:\n",
               context, digest->name );
        DBGC_HDA ( context, 0, value, digest_len );
 
        /* Construct encoded message */
        *(temp++) = 0x00;
        *(temp++) = 0x01;
        pad_len = ( 8 /* minimum padding */ + context->max_len - min_len );
        memset ( temp, 0xff, pad_len );
        temp += pad_len;
        *(temp++) = 0x00;
        if ( prefix ) {
                memcpy ( temp, prefix->data, prefix->len );
                temp += prefix->len;
        }
        memcpy ( temp, value, digest_len );
        temp += digest_len;
        assert ( temp == ( encoded + context->max_len ) );
        DBGC ( context, "RSA %p encoded %s digest using PKCS#1:\n",
               context, digest->name );
        DBGC_HDA ( context, 0, encoded, context->max_len );
 
        return 0;
}

References __unused, assert, DBGC, DBGC_HDA, rsa_digestinfo_prefix::digest, digest_algorithm::digestsize, ENOTSUP, ERANGE, is_md5_sha1(), rsa_context::max_len, memcpy(), memset(), digest_algorithm::name, prefix, rsa_find_prefix(), and value.

rsa_xor_mask()

void rsa_xor_mask ( struct digest_algorithm * digest, void * ctx, void * out, const void * seed, void * xor, size_t len )

static

Apply RSA PSS mask generation function.

Parameters

digest	Digest algorithm
ctx	Digest context buffer
out	Digest output buffer
seed	Mask seed
xor	XOR buffer
len	Length of XOR buffer

Definition at line 581 of file rsa.c.

                                        {
        size_t digest_len = digest->digestsize;
        const uint8_t *out_byte = out;
        uint8_t *xor_byte = xor;
        uint32_t counter = 0;
        unsigned int i;
 
        while ( len ) {
 
                /* Generate output */
                digest_init ( digest, ctx );
                digest_update ( digest, ctx, seed, digest_len );
                digest_update ( digest, ctx, &counter, sizeof ( counter ) );
                digest_final ( digest, ctx, out );
 
                /* XOR output into buffer */
                for ( i = 0 ; len && ( i < digest_len ) ; i++, len-- )
                        *(xor_byte++) ^= out_byte[i];
 
                /* Increment counter */
                counter = htonl ( ntohl ( counter ) + 1 );
        }
}

References ctx, rsa_digestinfo_prefix::digest, digest_final(), digest_init(), digest_update(), digest_algorithm::digestsize, htonl, len, ntohl, out, and xor().

Referenced by rsa_pss_encode().

rsa_pss_encode()

int rsa_pss_encode ( struct rsa_context * context, struct digest_algorithm * digest, const void * value, const void * reference, void * encoded )

static

Encode digest using RSA PSS.

Parameters

context	RSA context
digest	Digest algorithm
value	Digest value
reference	Reference encoded digest (or NULL)
encoded	Encoded digest

Return values

rc	Return status code

Definition at line 617 of file rsa.c.

                                            {
        static uint8_t zero[8];
        uint8_t ctx[ digest->ctxsize ];
        uint8_t out[ digest->digestsize ];
        size_t digest_len = digest->digestsize;
        size_t mask_len;
        size_t pad_len;
        size_t min_len;
        void *hash;
        void *salt;
        uint8_t *msb;
        uint8_t *head;
        uint8_t *tail;
        int rc;
 
        /* Sanity check */
        min_len = ( sizeof ( *head ) + digest_len /* salt */ +
                    digest_len /* hash */ + sizeof ( *tail ) );
        if ( context->max_len < min_len ) {
                DBGC ( context, "RSA %p %s formatted digest value too long "
                       "(%zd bytes, max %zd)\n", context, digest->name,
                       min_len, context->max_len );
                return -ERANGE;
        }
        DBGC ( context, "RSA %p encoding %s digest using PSS:\n",
               context, digest->name );
        DBGC_HDA ( context, 0, value, digest_len );
 
        /* Split message into component parts */
        pad_len = ( context->max_len - min_len );
        msb = encoded;
        head = ( msb + pad_len );
        salt = ( head + sizeof ( *head ) );
        hash = ( salt + digest_len );
        tail = ( hash + digest_len );
        mask_len = ( pad_len + sizeof ( *head ) + digest_len /* salt */ );
        assert ( tail == ( encoded + context->max_len - 1 ) );
 
        /* Generate or construct salt as applicable */
        if ( reference ) {
                memcpy ( encoded, reference, context->max_len );
                rsa_xor_mask ( digest, ctx, out, hash, encoded, mask_len );
        } else {
                if ( ( rc = rsa_get_random ( salt, digest_len ) ) != 0 ) {
                        DBGC ( context, "RSA %p could not generate random "
                               "salt: %s\n", context, strerror ( rc ) );
                        return rc;
                }
        }
        DBGC ( context, "RSA %p salt:\n", context );
        DBGC_HDA ( context, 0, salt, digest_len );
 
        /* Construct intermediate digest */
        digest_init ( digest, ctx );
        digest_update ( digest, ctx, zero, sizeof ( zero ) );
        digest_update ( digest, ctx, value, digest_len );
        digest_update ( digest, ctx, salt, digest_len );
        digest_final ( digest, ctx, hash );
 
        /* Construct message */
        memset ( encoded, 0, pad_len );
        *head = 0x01;
        rsa_xor_mask ( digest, ctx, out, hash, encoded, mask_len );
        *msb &= context->mask;
        *tail = 0xbc;
        DBGC ( context, "RSA %p encoded %s digest using PSS:\n",
               context, digest->name );
        DBGC_HDA ( context, 0, encoded, context->max_len );
 
        return 0;
}

References assert, ctx, digest_algorithm::ctxsize, DBGC, DBGC_HDA, rsa_digestinfo_prefix::digest, digest_final(), digest_init(), digest_update(), digest_algorithm::digestsize, ERANGE, hash, head, rsa_context::mask, rsa_context::max_len, memcpy(), memset(), digest_algorithm::name, out, rc, rsa_get_random, rsa_xor_mask(), strerror(), and value.

rsa_sign()

int rsa_sign ( struct pubkey_algorithm * pubkey, const struct asn1_cursor * key, struct digest_algorithm * digest, const void * value, struct asn1_builder * signature )

static

Sign digest value using RSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 702 of file rsa.c.

                                                       {
        rsa_encode_t *encode = pubkey->priv;
        struct rsa_context context;
        int canonical;
        int rc;
 
        DBGC ( &context, "RSA %p signing %s digest:\n",
               &context, digest->name );
        DBGC_HDA ( &context, 0, value, digest->digestsize );
 
        /* Initialise context */
        if ( ( rc = rsa_init ( &context, key ) ) != 0 )
                goto err_init;
 
        /* Create space for encoded digest and signature */
        if ( ( rc = asn1_grow ( signature, context.max_len ) ) != 0 )
                goto err_grow;
 
        /* Encode digest */
        if ( ( rc = encode ( &context, digest, value, NULL,
                             signature->data ) ) != 0 )
                goto err_encode;
 
        /* Encipher the encoded digest */
        canonical = rsa_cipher ( &context, signature->data, signature->data );
        assert ( canonical );
        DBGC ( &context, "RSA %p signed %s digest:\n", &context, digest->name );
        DBGC_HDA ( &context, 0, signature->data, signature->len );
 
        /* Free context */
        rsa_free ( &context );
 
        return 0;
 
 err_encode:
 err_grow:
        rsa_free ( &context );
 err_init:
        return rc;
}

References asn1_grow(), assert, DBGC, DBGC_HDA, digest_algorithm::digestsize, key, rsa_context::max_len, digest_algorithm::name, NULL, pubkey_algorithm::priv, rc, rsa_cipher(), rsa_free(), rsa_init(), signature, and value.

rsa_verify()

int rsa_verify ( struct pubkey_algorithm * pubkey, const struct asn1_cursor * key, struct digest_algorithm * digest, const void * value, const struct asn1_cursor * signature )

static

Verify signed digest value using RSA.

Parameters

pubkey	Public-key algorithm
key	Key
digest	Digest algorithm
value	Digest value
signature	Signature

Return values

rc	Return status code

Definition at line 756 of file rsa.c.

                                                              {
        rsa_encode_t *encode = pubkey->priv;
        struct rsa_context context;
        void *temp;
        void *expected;
        void *actual;
        int canonical;
        int rc;
 
        DBGC ( &context, "RSA %p verifying %s digest:\n",
               &context, digest->name );
        DBGC_HDA ( &context, 0, value, digest->digestsize );
        DBGC_HDA ( &context, 0, signature->data, signature->len );
 
        /* Initialise context */
        if ( ( rc = rsa_init ( &context, key ) ) != 0 )
                goto err_init;
 
        /* Sanity check */
        if ( signature->len != context.max_len ) {
                DBGC ( &context, "RSA %p signature incorrect length (%zd "
                       "bytes, should be %zd)\n",
                       &context, signature->len, context.max_len );
                rc = -ERANGE;
                goto err_sanity;
        }
 
        /* Decipher the signature (using the big integer input buffer
         * as temporary storage)
         */
        temp = context.input0;
        expected = temp;
        canonical = rsa_cipher ( &context, signature->data, expected );
        DBGC ( &context, "RSA %p deciphered signature:\n", &context );
        DBGC_HDA ( &context, 0, expected, context.max_len );
        if ( ! canonical ) {
                DBGC ( &context, "RSA %p signature was not canonical\n",
                       &context );
                rc = -ERANGE;
                goto err_canonical;
        }
 
        /* Encode digest (using the big integer output buffer as
         * temporary storage)
         */
        temp = context.output0;
        actual = temp;
        if ( ( rc = encode ( &context, digest, value, expected,
                             actual ) ) != 0 )
                goto err_encode;
 
        /* Verify the signature */
        if ( memcmp ( actual, expected, context.max_len ) != 0 ) {
                DBGC ( &context, "RSA %p signature verification failed\n",
                       &context );
                rc = -EACCES_VERIFY;
                goto err_verify;
        }
 
        /* Free context */
        rsa_free ( &context );
 
        DBGC ( &context, "RSA %p signature verified successfully\n", &context );
        return 0;
 
 err_verify:
 err_encode:
 err_canonical:
 err_sanity:
        rsa_free ( &context );
 err_init:
        return rc;
}

References DBGC, DBGC_HDA, digest_algorithm::digestsize, EACCES_VERIFY, ERANGE, rsa_context::input0, key, rsa_context::max_len, memcmp(), digest_algorithm::name, rsa_context::output0, pubkey_algorithm::priv, rc, rsa_cipher(), rsa_free(), rsa_init(), signature, and value.

rsa_match()

int rsa_match ( struct pubkey_algorithm *pubkey __unused, const struct asn1_cursor * private_key, const struct asn1_cursor * public_key )

static

Check for matching RSA public/private key pair.

Parameters

pubkey	Public-key algorithm
private_key	Private key
public_key	Public key

Return values

rc	Return status code

Definition at line 841 of file rsa.c.

                                                              {
        struct asn1_cursor private_modulus;
        struct asn1_cursor private_exponent;
        struct asn1_cursor public_modulus;
        struct asn1_cursor public_exponent;
        int rc;
 
        /* Parse moduli and exponents */
        if ( ( rc = rsa_parse_mod_exp ( &private_modulus, &private_exponent,
                                        private_key ) ) != 0 )
                return rc;
        if ( ( rc = rsa_parse_mod_exp ( &public_modulus, &public_exponent,
                                        public_key ) ) != 0 )
                return rc;
 
        /* Compare moduli */
        if ( asn1_compare ( &private_modulus, &public_modulus ) != 0 )
                return -ENOTTY;
 
        return 0;
}

References __unused, asn1_compare(), ENOTTY, rc, and rsa_parse_mod_exp().

REQUIRING_SYMBOL()

REQUIRING_SYMBOL

(

rsa_algorithm

)

References rsa_algorithm.

REQUIRE_OBJECT()

REQUIRE_OBJECT

(

config_crypto

)

Variable Documentation

rsa_get_random

int(* rsa_get_random) (void *data, size_t len)	(	void *	data,
		size_t	len ) = get_random_nz

Generate random data.

Definition at line 94 of file rsa.c.

Referenced by rsa_pkcs1_encrypt(), rsa_pss_encode(), and rsa_test_exec().

rsa_algorithm

struct pubkey_algorithm rsa_algorithm

Initial value:

                      = {
        .name           = "rsa",
        .encrypt        = rsa_pkcs1_encrypt,
        .decrypt        = rsa_pkcs1_decrypt,
        .sign           = rsa_sign,
        .verify         = rsa_verify,
        .match          = rsa_match,
        .priv           = rsa_pkcs1_encode,
}

RSA public-key algorithm.

Definition at line 866 of file rsa.c.

                                      {
        .name           = "rsa",
        .encrypt        = rsa_pkcs1_encrypt,
        .decrypt        = rsa_pkcs1_decrypt,
        .sign           = rsa_sign,
        .verify         = rsa_verify,
        .match          = rsa_match,
        .priv           = rsa_pkcs1_encode,
};

rsa_pss_algorithm

struct pubkey_algorithm rsa_pss_algorithm

Initial value:

                      = {
        .name           = "rsa_pss",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = rsa_sign,
        .verify         = rsa_verify,
        .match          = rsa_match,
        .priv           = rsa_pss_encode,
}

RSA-PSS public-key algorithm.

Definition at line 877 of file rsa.c.

                                          {
        .name           = "rsa_pss",
        .encrypt        = pubkey_null_encrypt,
        .decrypt        = pubkey_null_decrypt,
        .sign           = rsa_sign,
        .verify         = rsa_verify,
        .match          = rsa_match,
        .priv           = rsa_pss_encode,
};

Referenced by PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), PUBKEY_TEST(), and PUBKEY_TEST().