crypto/rsa/rsa_pk1.c

/* crypto/rsa/rsa_pk1.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include "../constant_time_locl.h"

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
#include <openssl/rand.h>

int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
             const unsigned char *from, int flen)
        {
        int j;
        unsigned char *p;

        if (flen > (tlen-RSA_PKCS1_PADDING_SIZE))
                {
                RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
                return(0);
                }
        
        p=(unsigned char *)to;

        *(p++)=0;
        *(p++)=1; /* Private Key BT (Block Type) */

        /* pad out with 0xff data */
        j=tlen-3-flen;
        memset(p,0xff,j);
        p+=j;
        *(p++)='\0';
        memcpy(p,from,(unsigned int)flen);
        return(1);
        }

int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
             const unsigned char *from, int flen, int num)
        {
        int i,j;
        const unsigned char *p;

        p=from;
        if ((num != (flen+1)) || (*(p++) != 01))
                {
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BLOCK_TYPE_IS_NOT_01);
                return(-1);
                }

        /* scan over padding data */
        j=flen-1; /* one for type. */
        for (i=0; i<j; i++)
                {
                if (*p != 0xff) /* should decrypt to 0xff */
                        {
                        if (*p == 0)
                                { p++; break; }
                        else    {
                                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BAD_FIXED_HEADER_DECRYPT);
                                return(-1);
                                }
                        }
                p++;
                }

        if (i == j)
                {
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_NULL_BEFORE_BLOCK_MISSING);
                return(-1);
                }

        if (i < 8)
                {
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BAD_PAD_BYTE_COUNT);
                return(-1);
                }
        i++; /* Skip over the '\0' */
        j-=i;
        if (j > tlen)
                {
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE);
                return(-1);
                }
        memcpy(to,p,(unsigned int)j);

        return(j);
        }

int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
             const unsigned char *from, int flen)
        {
        int i,j;
        unsigned char *p;
        
        if (flen > (tlen-11))
                {
                RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
                return(0);
                }
        
        p=(unsigned char *)to;

        *(p++)=0;
        *(p++)=2; /* Public Key BT (Block Type) */

        /* pad out with non-zero random data */
        j=tlen-3-flen;

        if (RAND_bytes(p,j) <= 0)
                return(0);
        for (i=0; i<j; i++)
                {
                if (*p == '\0')
                        do      {
                                if (RAND_bytes(p,1) <= 0)
                                        return(0);
                                } while (*p == '\0');
                p++;
                }

        *(p++)='\0';

        memcpy(p,from,(unsigned int)flen);
        return(1);
        }

int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
             const unsigned char *from, int flen, int num)
        {
        int i;
        /* |em| is the encoded message, zero-padded to exactly |num| bytes */
        unsigned char *em = NULL;
        unsigned int good, found_zero_byte;
        int zero_index = 0, msg_index, mlen = -1;

        if (tlen < 0 || flen < 0)
                return -1;

        /* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography
         * Standard", section 7.2.2. */

        if (flen > num)
                goto err;

        if (num < 11)
                goto err;

        em = OPENSSL_malloc(num);
        if (em == NULL)
                {
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);
                return -1;
                }
        memset(em, 0, num);
        /*
         * Always do this zero-padding copy (even when num == flen) to avoid
         * leaking that information. The copy still leaks some side-channel
         * information, but it's impossible to have a fixed  memory access
         * pattern since we can't read out of the bounds of |from|.
         *
         * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL.
         */
        memcpy(em + num - flen, from, flen);

        good = constant_time_is_zero(em[0]);
        good &= constant_time_eq(em[1], 2);

        found_zero_byte = 0;
        for (i = 2; i < num; i++)
                {
                unsigned int equals0 = constant_time_is_zero(em[i]);
                zero_index = constant_time_select_int(~found_zero_byte & equals0, i, zero_index);
                found_zero_byte |= equals0;
                }

        /*
         * PS must be at least 8 bytes long, and it starts two bytes into |em|.
         * If we never found a 0-byte, then |zero_index| is 0 and the check
         * also fails.
         */
        good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);

        /* Skip the zero byte. This is incorrect if we never found a zero-byte
         * but in this case we also do not copy the message out. */
        msg_index = zero_index + 1;
        mlen = num - msg_index;

        /* For good measure, do this check in constant time as well; it could
         * leak something if |tlen| was assuming valid padding. */
        good &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));

        /*
         * We can't continue in constant-time because we need to copy the result
         * and we cannot fake its length. This unavoidably leaks timing
         * information at the API boundary.
         * TODO(emilia): this could be addressed at the call site,
         * see BoringSSL commit 0aa0767340baf925bda4804882aab0cb974b2d26.
         */
        if (!good)
                {
                mlen = -1;
                goto err;
                }

        memcpy(to, em + msg_index, mlen);

err:
        if (em != NULL)
                OPENSSL_free(em);
        if (mlen == -1)
                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);
        return mlen;
        }
Revision:	6895
Committed:	Tue Oct 28 11:51:38 2014 UTC (9 years, 6 months ago) by laffer1
Content type:	text/plain
File size:	8051 byte(s)
Log Message:	OpenSSL 0.9.8zc
#	Content
1	/* crypto/rsa/rsa_pk1.c */
2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3	* All rights reserved.
4	*
5	* This package is an SSL implementation written
6	* by Eric Young (eay@cryptsoft.com).
7	* The implementation was written so as to conform with Netscapes SSL.
8	*
9	* This library is free for commercial and non-commercial use as long as
10	* the following conditions are aheared to. The following conditions
11	* apply to all code found in this distribution, be it the RC4, RSA,
12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13	* included with this distribution is covered by the same copyright terms
14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
15	*
16	* Copyright remains Eric Young's, and as such any Copyright notices in
17	* the code are not to be removed.
18	* If this package is used in a product, Eric Young should be given attribution
19	* as the author of the parts of the library used.
20	* This can be in the form of a textual message at program startup or
21	* in documentation (online or textual) provided with the package.
22	*
23	* Redistribution and use in source and binary forms, with or without
24	* modification, are permitted provided that the following conditions
25	* are met:
26	* 1. Redistributions of source code must retain the copyright
27	* notice, this list of conditions and the following disclaimer.
28	* 2. Redistributions in binary form must reproduce the above copyright
29	* notice, this list of conditions and the following disclaimer in the
30	* documentation and/or other materials provided with the distribution.
31	* 3. All advertising materials mentioning features or use of this software
32	* must display the following acknowledgement:
33	* "This product includes cryptographic software written by
34	* Eric Young (eay@cryptsoft.com)"
35	* The word 'cryptographic' can be left out if the rouines from the library
36	* being used are not cryptographic related :-).
37	* 4. If you include any Windows specific code (or a derivative thereof) from
38	* the apps directory (application code) you must include an acknowledgement:
39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40	*
41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51	* SUCH DAMAGE.
52	*
53	* The licence and distribution terms for any publically available version or
54	* derivative of this code cannot be changed. i.e. this code cannot simply be
55	* copied and put under another distribution licence
56	* [including the GNU Public Licence.]
57	*/
58
59	#include "../constant_time_locl.h"
60
61	#include <stdio.h>
62	#include "cryptlib.h"
63	#include <openssl/bn.h>
64	#include <openssl/rsa.h>
65	#include <openssl/rand.h>
66
67	int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
68	const unsigned char *from, int flen)
69	{
70	int j;
71	unsigned char *p;
72
73	if (flen > (tlen-RSA_PKCS1_PADDING_SIZE))
74	{
75	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
76	return(0);
77	}
78
79	p=(unsigned char *)to;
80
81	*(p++)=0;
82	(p++)=1; / Private Key BT (Block Type) */
83
84	/* pad out with 0xff data */
85	j=tlen-3-flen;
86	memset(p,0xff,j);
87	p+=j;
88	*(p++)='\0';
89	memcpy(p,from,(unsigned int)flen);
90	return(1);
91	}
92
93	int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
94	const unsigned char *from, int flen, int num)
95	{
96	int i,j;
97	const unsigned char *p;
98
99	p=from;
100	if ((num != (flen+1)) \|\| (*(p++) != 01))
101	{
102	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BLOCK_TYPE_IS_NOT_01);
103	return(-1);
104	}
105
106	/* scan over padding data */
107	j=flen-1; /* one for type. */
108	for (i=0; i<j; i++)
109	{
110	if (p != 0xff) / should decrypt to 0xff */
111	{
112	if (*p == 0)
113	{ p++; break; }
114	else {
115	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BAD_FIXED_HEADER_DECRYPT);
116	return(-1);
117	}
118	}
119	p++;
120	}
121
122	if (i == j)
123	{
124	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_NULL_BEFORE_BLOCK_MISSING);
125	return(-1);
126	}
127
128	if (i < 8)
129	{
130	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_BAD_PAD_BYTE_COUNT);
131	return(-1);
132	}
133	i++; /* Skip over the '\0' */
134	j-=i;
135	if (j > tlen)
136	{
137	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE);
138	return(-1);
139	}
140	memcpy(to,p,(unsigned int)j);
141
142	return(j);
143	}
144
145	int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
146	const unsigned char *from, int flen)
147	{
148	int i,j;
149	unsigned char *p;
150
151	if (flen > (tlen-11))
152	{
153	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
154	return(0);
155	}
156
157	p=(unsigned char *)to;
158
159	*(p++)=0;
160	(p++)=2; / Public Key BT (Block Type) */
161
162	/* pad out with non-zero random data */
163	j=tlen-3-flen;
164
165	if (RAND_bytes(p,j) <= 0)
166	return(0);
167	for (i=0; i<j; i++)
168	{
169	if (*p == '\0')
170	do {
171	if (RAND_bytes(p,1) <= 0)
172	return(0);
173	} while (*p == '\0');
174	p++;
175	}
176
177	*(p++)='\0';
178
179	memcpy(p,from,(unsigned int)flen);
180	return(1);
181	}
182
183	int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
184	const unsigned char *from, int flen, int num)
185	{
186	int i;
187	/* \|em\| is the encoded message, zero-padded to exactly \|num\| bytes */
188	unsigned char *em = NULL;
189	unsigned int good, found_zero_byte;
190	int zero_index = 0, msg_index, mlen = -1;
191
192	if (tlen < 0 \|\| flen < 0)
193	return -1;
194
195	/* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography
196	* Standard", section 7.2.2. */
197
198	if (flen > num)
199	goto err;
200
201	if (num < 11)
202	goto err;
203
204	em = OPENSSL_malloc(num);
205	if (em == NULL)
206	{
207	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);
208	return -1;
209	}
210	memset(em, 0, num);
211	/*
212	* Always do this zero-padding copy (even when num == flen) to avoid
213	* leaking that information. The copy still leaks some side-channel
214	* information, but it's impossible to have a fixed memory access
215	* pattern since we can't read out of the bounds of \|from\|.
216	*
217	* TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL.
218	*/
219	memcpy(em + num - flen, from, flen);
220
221	good = constant_time_is_zero(em[0]);
222	good &= constant_time_eq(em[1], 2);
223
224	found_zero_byte = 0;
225	for (i = 2; i < num; i++)
226	{
227	unsigned int equals0 = constant_time_is_zero(em[i]);
228	zero_index = constant_time_select_int(~found_zero_byte & equals0, i, zero_index);
229	found_zero_byte \|= equals0;
230	}
231
232	/*
233	* PS must be at least 8 bytes long, and it starts two bytes into \|em\|.
234	* If we never found a 0-byte, then \|zero_index\| is 0 and the check
235	* also fails.
236	*/
237	good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);
238
239	/* Skip the zero byte. This is incorrect if we never found a zero-byte
240	* but in this case we also do not copy the message out. */
241	msg_index = zero_index + 1;
242	mlen = num - msg_index;
243
244	/* For good measure, do this check in constant time as well; it could
245	* leak something if \|tlen\| was assuming valid padding. */
246	good &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));
247
248	/*
249	* We can't continue in constant-time because we need to copy the result
250	* and we cannot fake its length. This unavoidably leaks timing
251	* information at the API boundary.
252	* TODO(emilia): this could be addressed at the call site,
253	* see BoringSSL commit 0aa0767340baf925bda4804882aab0cb974b2d26.
254	*/
255	if (!good)
256	{
257	mlen = -1;
258	goto err;
259	}
260
261	memcpy(to, em + msg_index, mlen);
262
263	err:
264	if (em != NULL)
265	OPENSSL_free(em);
266	if (mlen == -1)
267	RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);
268	return mlen;
269	}