Home | History | Annotate | Line # | Download | only in tls 
      1 /*
      2  * PKCS #1 (RSA Encryption)
      3  * Copyright (c) 2006-2014, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This software may be distributed under the terms of the BSD license.
      6  * See README for more details.
      7  */
      8 
      9 #include "includes.h"
     10 
     11 #include "common.h"
     12 #include "crypto/crypto.h"
     13 #include "rsa.h"
     14 #include "asn1.h"
     15 #include "pkcs1.h"
     16 
     17 
     18 static int pkcs1_generate_encryption_block(u8 block_type, size_t modlen,
     19 					   const u8 *in, size_t inlen,
     20 					   u8 *out, size_t *outlen)
     21 {
     22 	size_t ps_len;
     23 	u8 *pos;
     24 
     25 	/*
     26 	 * PKCS #1 v1.5, 8.1:
     27 	 *
     28 	 * EB = 00 || BT || PS || 00 || D
     29 	 * BT = 00 or 01 for private-key operation; 02 for public-key operation
     30 	 * PS = k-3-||D||; at least eight octets
     31 	 * (BT=0: PS=0x00, BT=1: PS=0xff, BT=2: PS=pseudorandom non-zero)
     32 	 * k = length of modulus in octets (modlen)
     33 	 */
     34 
     35 	if (modlen < 12 || modlen > *outlen || inlen > modlen - 11) {
     36 		wpa_printf(MSG_DEBUG, "PKCS #1: %s - Invalid buffer "
     37 			   "lengths (modlen=%lu outlen=%lu inlen=%lu)",
     38 			   __func__, (unsigned long) modlen,
     39 			   (unsigned long) *outlen,
     40 			   (unsigned long) inlen);
     41 		return -1;
     42 	}
     43 
     44 	pos = out;
     45 	*pos++ = 0x00;
     46 	*pos++ = block_type; /* BT */
     47 	ps_len = modlen - inlen - 3;
     48 	switch (block_type) {
     49 	case 0:
     50 		os_memset(pos, 0x00, ps_len);
     51 		pos += ps_len;
     52 		break;
     53 	case 1:
     54 		os_memset(pos, 0xff, ps_len);
     55 		pos += ps_len;
     56 		break;
     57 	case 2:
     58 		if (os_get_random(pos, ps_len) < 0) {
     59 			wpa_printf(MSG_DEBUG, "PKCS #1: %s - Failed to get "
     60 				   "random data for PS", __func__);
     61 			return -1;
     62 		}
     63 		while (ps_len--) {
     64 			if (*pos == 0x00)
     65 				*pos = 0x01;
     66 			pos++;
     67 		}
     68 		break;
     69 	default:
     70 		wpa_printf(MSG_DEBUG, "PKCS #1: %s - Unsupported block type "
     71 			   "%d", __func__, block_type);
     72 		return -1;
     73 	}
     74 	*pos++ = 0x00;
     75 	os_memcpy(pos, in, inlen); /* D */
     76 
     77 	return 0;
     78 }
     79 
     80 
     81 int pkcs1_encrypt(int block_type, struct crypto_rsa_key *key,
     82 		  int use_private, const u8 *in, size_t inlen,
     83 		  u8 *out, size_t *outlen)
     84 {
     85 	size_t modlen;
     86 
     87 	modlen = crypto_rsa_get_modulus_len(key);
     88 
     89 	if (pkcs1_generate_encryption_block(block_type, modlen, in, inlen,
     90 					    out, outlen) < 0)
     91 		return -1;
     92 
     93 	return crypto_rsa_exptmod(out, modlen, out, outlen, key, use_private);
     94 }
     95 
     96 
     97 int pkcs1_v15_private_key_decrypt(struct crypto_rsa_key *key,
     98 				  const u8 *in, size_t inlen,
     99 				  u8 *out, size_t *outlen)
    100 {
    101 	int res;
    102 	u8 *pos, *end;
    103 
    104 	res = crypto_rsa_exptmod(in, inlen, out, outlen, key, 1);
    105 	if (res)
    106 		return res;
    107 
    108 	if (*outlen < 2 || out[0] != 0 || out[1] != 2)
    109 		return -1;
    110 
    111 	/* Skip PS (pseudorandom non-zero octets) */
    112 	pos = out + 2;
    113 	end = out + *outlen;
    114 	while (*pos && pos < end)
    115 		pos++;
    116 	if (pos == end)
    117 		return -1;
    118 	if (pos - out - 2 < 8) {
    119 		/* PKCS #1 v1.5, 8.1: At least eight octets long PS */
    120 		wpa_printf(MSG_INFO, "LibTomCrypt: Too short padding");
    121 		return -1;
    122 	}
    123 	pos++;
    124 
    125 	*outlen -= pos - out;
    126 
    127 	/* Strip PKCS #1 header */
    128 	os_memmove(out, pos, *outlen);
    129 
    130 	return 0;
    131 }
    132 
    133 
    134 int pkcs1_decrypt_public_key(struct crypto_rsa_key *key,
    135 			     const u8 *crypt, size_t crypt_len,
    136 			     u8 *plain, size_t *plain_len)
    137 {
    138 	size_t len;
    139 	u8 *pos;
    140 
    141 	len = *plain_len;
    142 	if (crypto_rsa_exptmod(crypt, crypt_len, plain, &len, key, 0) < 0)
    143 		return -1;
    144 
    145 	/*
    146 	 * PKCS #1 v1.5, 8.1:
    147 	 *
    148 	 * EB = 00 || BT || PS || 00 || D
    149 	 * BT = 00 or 01
    150 	 * PS = k-3-||D|| times (00 if BT=00) or (FF if BT=01)
    151 	 * k = length of modulus in octets
    152 	 *
    153 	 * Based on 10.1.3, "The block type shall be 01" for a signature.
    154 	 */
    155 
    156 	if (len < 3 + 8 + 16 /* min hash len */ ||
    157 	    plain[0] != 0x00 || plain[1] != 0x01) {
    158 		wpa_printf(MSG_INFO, "LibTomCrypt: Invalid signature EB "
    159 			   "structure");
    160 		wpa_hexdump_key(MSG_DEBUG, "Signature EB", plain, len);
    161 		return -1;
    162 	}
    163 
    164 	pos = plain + 3;
    165 	/* BT = 01 */
    166 	if (plain[2] != 0xff) {
    167 		wpa_printf(MSG_INFO, "LibTomCrypt: Invalid signature "
    168 			   "PS (BT=01)");
    169 		wpa_hexdump_key(MSG_DEBUG, "Signature EB", plain, len);
    170 		return -1;
    171 	}
    172 	while (pos < plain + len && *pos == 0xff)
    173 		pos++;
    174 
    175 	if (pos - plain - 2 < 8) {
    176 		/* PKCS #1 v1.5, 8.1: At least eight octets long PS */
    177 		wpa_printf(MSG_INFO, "LibTomCrypt: Too short signature "
    178 			   "padding");
    179 		wpa_hexdump_key(MSG_DEBUG, "Signature EB", plain, len);
    180 		return -1;
    181 	}
    182 
    183 	if (pos + 16 /* min hash len */ >= plain + len || *pos != 0x00) {
    184 		wpa_printf(MSG_INFO, "LibTomCrypt: Invalid signature EB "
    185 			   "structure (2)");
    186 		wpa_hexdump_key(MSG_DEBUG, "Signature EB", plain, len);
    187 		return -1;
    188 	}
    189 	pos++;
    190 	len -= pos - plain;
    191 
    192 	/* Strip PKCS #1 header */
    193 	os_memmove(plain, pos, len);
    194 	*plain_len = len;
    195 
    196 	return 0;
    197 }
    198 
    199 
    200 int pkcs1_v15_sig_ver(struct crypto_public_key *pk,
    201 		      const u8 *s, size_t s_len,
    202 		      const struct asn1_oid *hash_alg,
    203 		      const u8 *hash, size_t hash_len)
    204 {
    205 	int res;
    206 	u8 *decrypted;
    207 	size_t decrypted_len;
    208 	const u8 *pos, *end, *next, *da_end;
    209 	struct asn1_hdr hdr;
    210 	struct asn1_oid oid;
    211 
    212 	decrypted = os_malloc(s_len);
    213 	if (decrypted == NULL)
    214 		return -1;
    215 	decrypted_len = s_len;
    216 	res = crypto_public_key_decrypt_pkcs1(pk, s, s_len, decrypted,
    217 					      &decrypted_len);
    218 	if (res < 0) {
    219 		wpa_printf(MSG_INFO, "PKCS #1: RSA decrypt failed");
    220 		os_free(decrypted);
    221 		return -1;
    222 	}
    223 	wpa_hexdump(MSG_DEBUG, "Decrypted(S)", decrypted, decrypted_len);
    224 
    225 	/*
    226 	 * PKCS #1 v1.5, 10.1.2:
    227 	 *
    228 	 * DigestInfo ::= SEQUENCE {
    229 	 *     digestAlgorithm DigestAlgorithmIdentifier,
    230 	 *     digest Digest
    231 	 * }
    232 	 *
    233 	 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
    234 	 *
    235 	 * Digest ::= OCTET STRING
    236 	 *
    237 	 */
    238 	if (asn1_get_next(decrypted, decrypted_len, &hdr) < 0 ||
    239 	    !asn1_is_sequence(&hdr)) {
    240 		asn1_unexpected(&hdr,
    241 				"PKCS #1: Expected SEQUENCE (DigestInfo)");
    242 		os_free(decrypted);
    243 		return -1;
    244 	}
    245 	wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestInfo",
    246 		    hdr.payload, hdr.length);
    247 
    248 	pos = hdr.payload;
    249 	end = pos + hdr.length;
    250 
    251 	/*
    252 	 * X.509:
    253 	 * AlgorithmIdentifier ::= SEQUENCE {
    254 	 *     algorithm            OBJECT IDENTIFIER,
    255 	 *     parameters           ANY DEFINED BY algorithm OPTIONAL
    256 	 * }
    257 	 */
    258 
    259 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||
    260 	    !asn1_is_sequence(&hdr)) {
    261 		asn1_unexpected(&hdr,
    262 				"PKCS #1: Expected SEQUENCE (AlgorithmIdentifier)");
    263 		os_free(decrypted);
    264 		return -1;
    265 	}
    266 	wpa_hexdump(MSG_MSGDUMP, "PKCS #1: DigestAlgorithmIdentifier",
    267 		    hdr.payload, hdr.length);
    268 	da_end = hdr.payload + hdr.length;
    269 
    270 	if (asn1_get_oid(hdr.payload, hdr.length, &oid, &next)) {
    271 		wpa_printf(MSG_DEBUG,
    272 			   "PKCS #1: Failed to parse digestAlgorithm");
    273 		os_free(decrypted);
    274 		return -1;
    275 	}
    276 	wpa_hexdump(MSG_MSGDUMP, "PKCS #1: Digest algorithm parameters",
    277 		    next, da_end - next);
    278 
    279 	/*
    280 	 * RFC 5754: The correct encoding for the SHA2 algorithms would be to
    281 	 * omit the parameters, but there are implementation that encode these
    282 	 * as a NULL element. Allow these two cases and reject anything else.
    283 	 */
    284 	if (da_end > next &&
    285 	    (asn1_get_next(next, da_end - next, &hdr) < 0 ||
    286 	     !asn1_is_null(&hdr) ||
    287 	     hdr.payload + hdr.length != da_end)) {
    288 		wpa_printf(MSG_DEBUG,
    289 			   "PKCS #1: Unexpected digest algorithm parameters");
    290 		os_free(decrypted);
    291 		return -1;
    292 	}
    293 
    294 	if (!asn1_oid_equal(&oid, hash_alg)) {
    295 		char txt[100], txt2[100];
    296 		asn1_oid_to_str(&oid, txt, sizeof(txt));
    297 		asn1_oid_to_str(hash_alg, txt2, sizeof(txt2));
    298 		wpa_printf(MSG_DEBUG,
    299 			   "PKCS #1: Hash alg OID mismatch: was %s, expected %s",
    300 			   txt, txt2);
    301 		os_free(decrypted);
    302 		return -1;
    303 	}
    304 
    305 	/* Digest ::= OCTET STRING */
    306 	pos = da_end;
    307 
    308 	if (asn1_get_next(pos, end - pos, &hdr) < 0 ||
    309 	    !asn1_is_octetstring(&hdr)) {
    310 		asn1_unexpected(&hdr,
    311 				"PKCS #1: Expected OCTETSTRING (Digest)");
    312 		os_free(decrypted);
    313 		return -1;
    314 	}
    315 	wpa_hexdump(MSG_MSGDUMP, "PKCS #1: Decrypted Digest",
    316 		    hdr.payload, hdr.length);
    317 
    318 	if (hdr.length != hash_len ||
    319 	    os_memcmp_const(hdr.payload, hash, hdr.length) != 0) {
    320 		wpa_printf(MSG_INFO, "PKCS #1: Digest value does not match calculated hash");
    321 		os_free(decrypted);
    322 		return -1;
    323 	}
    324 
    325 	if (hdr.payload + hdr.length != decrypted + decrypted_len) {
    326 		wpa_printf(MSG_INFO,
    327 			   "PKCS #1: Extra data after signature - reject");
    328 
    329 		wpa_hexdump(MSG_DEBUG, "PKCS #1: Extra data",
    330 			    hdr.payload + hdr.length,
    331 			    decrypted + decrypted_len - hdr.payload -
    332 			    hdr.length);
    333 
    334 		os_free(decrypted);
    335 		return -1;
    336 	}
    337 
    338 	os_free(decrypted);
    339 
    340 	return 0;
    341 }
    342