Skip to content

Commit 50c8701

Browse files
sjaeckelsjaeckel
committed
Introduce new RSA API.
This also: a) deprecates the old RSA and PKCS#1 API. b) reverts the changes done to them in order to make them API compatible again with the last release. The fixes commit mentioned is the testcase for the Bleichenbacher attack, which works now again as expected. Fixes: 9d03c38 ("add flags to `der_decode_sequence()`") Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>
1 parent 0be11ff commit 50c8701

17 files changed

+723
-403
lines changed

‎src/headers/tomcrypt_pk.h‎

Lines changed: 58 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,10 @@ typedef struct ltc_rsa_parameters {
7070
/** saltLength is only defined for PSS
7171
* If saltLength == 0 -> OAEP, else -> PSS */
7272
unsigned long saltlen;
73-
/** hash and MGF hash algorithms */
73+
/** lparam hash for OAEP
74+
* resp.
75+
* signature hash for PSS
76+
* and MGF hash algorithms */
7477
const char *hash_alg, *mgf1_hash_alg;
7578
} ltc_rsa_parameters;
7679

@@ -109,51 +112,93 @@ int rsa_exptmod(const unsigned char *in, unsigned long inlen,
109112

110113
void rsa_free(rsa_key *key);
111114

115+
typedef struct ltc_rsa_op_parameters {
116+
/* pss_oaep flag is unused */
117+
ltc_rsa_parameters params;
118+
/* The padding type */
119+
int padding;
120+
/* The PRNG to use.
121+
* Only required for signing and encryption. */
122+
int wprng;
123+
prng_state *prng;
124+
/* Operation-specific parameters */
125+
union {
126+
struct {
127+
const unsigned char *lparam;
128+
unsigned long lparamlen;
129+
} crypt;
130+
/* let's make space for potential future extensions */
131+
ulong64 dummy[8];
132+
} u;
133+
} ltc_rsa_op_parameters;
134+
135+
int rsa_encrypt_key_v2(const unsigned char *in, unsigned long inlen,
136+
unsigned char *out, unsigned long *outlen,
137+
ltc_rsa_op_parameters *opts,
138+
const rsa_key *key);
139+
140+
int rsa_decrypt_key_v2(const unsigned char *in, unsigned long inlen,
141+
unsigned char *out, unsigned long *outlen,
142+
ltc_rsa_op_parameters *opts,
143+
int *stat,
144+
const rsa_key *key);
145+
146+
int rsa_sign_hash_v2(const unsigned char *hash, unsigned long hashlen,
147+
unsigned char *sig, unsigned long *siglen,
148+
ltc_rsa_op_parameters *opts,
149+
const rsa_key *key);
150+
151+
int rsa_verify_hash_v2(const unsigned char *sig, unsigned long siglen,
152+
const unsigned char *hash, unsigned long hashlen,
153+
ltc_rsa_op_parameters *opts,
154+
int *stat,
155+
const rsa_key *key);
156+
112157
/* These use PKCS #1 v2.0 padding */
113158
#define rsa_encrypt_key(in, inlen, out, outlen, lparam, lparamlen, prng, prng_idx, hash_idx, key) \
114-
rsa_encrypt_key_ex(in, inlen, out, outlen, lparam, lparamlen, prng, prng_idx, hash_idx, -1, LTC_PKCS_1_OAEP, key)
159+
rsa_encrypt_key_ex(in, inlen, out, outlen, lparam, lparamlen, prng, prng_idx, hash_idx, LTC_PKCS_1_OAEP, key)
115160

116161
#define rsa_decrypt_key(in, inlen, out, outlen, lparam, lparamlen, hash_idx, stat, key) \
117-
rsa_decrypt_key_ex(in, inlen, out, outlen, lparam, lparamlen, hash_idx, -1, LTC_PKCS_1_OAEP, stat, key)
162+
rsa_decrypt_key_ex(in, inlen, out, outlen, lparam, lparamlen, hash_idx, LTC_PKCS_1_OAEP, stat, key)
118163

119164
#define rsa_sign_hash(in, inlen, out, outlen, prng, prng_idx, hash_idx, saltlen, key) \
120-
rsa_sign_hash_ex(in, inlen, out, outlen, LTC_PKCS_1_PSS, prng, prng_idx, hash_idx, hash_idx, saltlen, key)
165+
rsa_sign_hash_ex(in, inlen, out, outlen, LTC_PKCS_1_PSS, prng, prng_idx, hash_idx, saltlen, key)
121166

122167
#define rsa_verify_hash(sig, siglen, hash, hashlen, hash_idx, saltlen, stat, key) \
123-
rsa_verify_hash_ex(sig, siglen, hash, hashlen, LTC_PKCS_1_PSS, hash_idx, hash_idx, saltlen, stat, key)
168+
rsa_verify_hash_ex(sig, siglen, hash, hashlen, LTC_PKCS_1_PSS, hash_idx, saltlen, stat, key)
124169

125170
#define rsa_sign_saltlen_get_max(hash_idx, key) \
126171
rsa_sign_saltlen_get_max_ex(LTC_PKCS_1_PSS, hash_idx, key)
127172

128173
/* These can be switched between PKCS #1 v2.x and PKCS #1 v1.5 paddings */
174+
LTC_DEPRECATED(rsa_encrypt_key_v2)
129175
int rsa_encrypt_key_ex(const unsigned char *in, unsigned long inlen,
130176
unsigned char *out, unsigned long *outlen,
131177
const unsigned char *lparam, unsigned long lparamlen,
132178
prng_state *prng, int prng_idx,
133-
int mgf_hash, int lparam_hash,
134-
int padding,
179+
int hash_idx, int padding,
135180
const rsa_key *key);
136181

182+
LTC_DEPRECATED(rsa_decrypt_key_v2)
137183
int rsa_decrypt_key_ex(const unsigned char *in, unsigned long inlen,
138184
unsigned char *out, unsigned long *outlen,
139185
const unsigned char *lparam, unsigned long lparamlen,
140-
int mgf_hash, int lparam_hash,
141-
int padding,
186+
int hash_idx, int padding,
142187
int *stat, const rsa_key *key);
143188

189+
LTC_DEPRECATED(rsa_sign_hash_v2)
144190
int rsa_sign_hash_ex(const unsigned char *in, unsigned long inlen,
145191
unsigned char *out, unsigned long *outlen,
146192
int padding,
147193
prng_state *prng, int prng_idx,
148-
int hash_idx, int mgf_hash_idx,
149-
unsigned long saltlen,
194+
int hash_idx, unsigned long saltlen,
150195
const rsa_key *key);
151196

197+
LTC_DEPRECATED(rsa_verify_hash_v2)
152198
int rsa_verify_hash_ex(const unsigned char *sig, unsigned long siglen,
153199
const unsigned char *hash, unsigned long hashlen,
154200
int padding,
155-
int hash_idx, int mgf_hash_idx,
156-
unsigned long saltlen,
201+
int hash_idx, unsigned long saltlen,
157202
int *stat, const rsa_key *key);
158203

159204
int rsa_sign_saltlen_get_max_ex(int padding, int hash_idx, const rsa_key *key);

‎src/headers/tomcrypt_pkcs.h‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,18 @@ enum ltc_pkcs_1_paddings
2020
LTC_PKCS_1_V1_5_NA1 = 4 /* PKCS #1 v1.5 padding - No ASN.1 (\sa ltc_pkcs_1_v1_5_blocks) */
2121
};
2222

23+
LTC_DEPRECATED(nothing. API will be internal)
2324
int pkcs_1_mgf1( int hash_idx,
2425
const unsigned char *seed, unsigned long seedlen,
2526
unsigned char *mask, unsigned long masklen);
2627

28+
LTC_DEPRECATED(nothing. API will be removed)
2729
int pkcs_1_i2osp(void *n, unsigned long modulus_len, unsigned char *out);
30+
LTC_DEPRECATED(nothing. API will be removed)
2831
int pkcs_1_os2ip(void *n, unsigned char *in, unsigned long inlen);
2932

3033
/* *** v1.5 padding */
34+
LTC_DEPRECATED(nothing. API will be internal)
3135
int pkcs_1_v1_5_encode(const unsigned char *msg,
3236
unsigned long msglen,
3337
int block_type,
@@ -37,6 +41,7 @@ int pkcs_1_v1_5_encode(const unsigned char *msg,
3741
unsigned char *out,
3842
unsigned long *outlen);
3943

44+
LTC_DEPRECATED(nothing. API will be internal)
4045
int pkcs_1_v1_5_decode(const unsigned char *msg,
4146
unsigned long msglen,
4247
int block_type,
@@ -46,26 +51,28 @@ int pkcs_1_v1_5_decode(const unsigned char *msg,
4651
int *is_valid);
4752

4853
/* *** v2.1 padding */
54+
LTC_DEPRECATED(nothing. API will be internal)
4955
int pkcs_1_oaep_encode(const unsigned char *msg, unsigned long msglen,
5056
const unsigned char *lparam, unsigned long lparamlen,
5157
unsigned long modulus_bitlen, prng_state *prng,
52-
int prng_idx,
53-
int mgf_hash, int lparam_hash,
58+
int prng_idx, int hash_idx,
5459
unsigned char *out, unsigned long *outlen);
5560

61+
LTC_DEPRECATED(nothing. API will be internal)
5662
int pkcs_1_oaep_decode(const unsigned char *msg, unsigned long msglen,
5763
const unsigned char *lparam, unsigned long lparamlen,
58-
unsigned long modulus_bitlen,
59-
int mgf_hash, int lparam_hash,
64+
unsigned long modulus_bitlen, int hash_idx,
6065
unsigned char *out, unsigned long *outlen,
6166
int *res);
6267

68+
LTC_DEPRECATED(nothing. API will be internal)
6369
int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
6470
unsigned long saltlen, prng_state *prng,
6571
int prng_idx, int hash_idx,
6672
unsigned long modulus_bitlen,
6773
unsigned char *out, unsigned long *outlen);
6874

75+
LTC_DEPRECATED(nothing. API will be internal)
6976
int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
7077
const unsigned char *sig, unsigned long siglen,
7178
unsigned long saltlen, int hash_idx,

‎src/headers/tomcrypt_private.h‎

Lines changed: 58 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -435,13 +435,51 @@ int pk_oid_cmp_with_ulong(const char *o1, const unsigned long *o2, unsigned long
435435

436436
/* ---- DH Routines ---- */
437437
#ifdef LTC_MRSA
438+
/* Receiving side, i.e. Decrypt or Verify */
439+
#define LTC_RSA_OP_RECV 0x00u
440+
/* Sending side, i.e. Encrypt or Sign */
441+
#define LTC_RSA_OP_SEND 0x01u
442+
/* En- or Decrypt */
443+
#define LTC_RSA_OP_CRYPT 0x00u
444+
/* Sign or Verify */
445+
#define LTC_RSA_OP_SIGN 0x02u
446+
/* All combinations of the above
447+
* but only the PKCS#1 de-/encoding part */
448+
#define LTC_RSA_OP_PKCS1 0x04u
449+
438450
typedef enum ltc_rsa_op {
439-
LTC_RSA_CRYPT,
440-
LTC_RSA_SIGN
451+
LTC_RSA_DECRYPT = LTC_RSA_OP_CRYPT | LTC_RSA_OP_RECV,
452+
LTC_RSA_ENCRYPT = LTC_RSA_OP_CRYPT | LTC_RSA_OP_SEND,
453+
LTC_RSA_VERIFY = LTC_RSA_OP_SIGN | LTC_RSA_OP_RECV,
454+
LTC_RSA_SIGN = LTC_RSA_OP_SIGN | LTC_RSA_OP_SEND,
455+
LTC_PKCS1_ENCRYPT = LTC_RSA_OP_PKCS1 | LTC_RSA_ENCRYPT,
456+
LTC_PKCS1_DECRYPT = LTC_RSA_OP_PKCS1 | LTC_RSA_DECRYPT,
457+
LTC_PKCS1_SIGN = LTC_RSA_OP_PKCS1 | LTC_RSA_SIGN,
458+
LTC_PKCS1_VERIFY = LTC_RSA_OP_PKCS1 | LTC_RSA_VERIFY,
441459
} ltc_rsa_op;
460+
461+
typedef struct ltc_rsa_op_check {
462+
const rsa_key *key;
463+
ltc_rsa_op_parameters *params;
464+
int hash_alg, mgf1_hash_alg;
465+
} ltc_rsa_op_checked;
466+
467+
#define ltc_rsa_op_checked_init(k, p) { \
468+
.key = k, \
469+
.params = p, \
470+
.hash_alg = -1, \
471+
.mgf1_hash_alg = -1, \
472+
}
473+
474+
#define ltc_pkcs1_op_checked_init(p) ltc_rsa_op_checked_init(NULL, p)
475+
442476
int rsa_init(rsa_key *key);
443477
void rsa_shrink_key(rsa_key *key);
444-
int rsa_key_valid_op(const rsa_key *key, ltc_rsa_op op, int padding, int hash_idx);
478+
int rsa_args_to_op_params(const unsigned char *lparam, unsigned long lparamlen,
479+
prng_state *prng, int prng_idx, int hash_idx,
480+
int padding, unsigned long saltlen,
481+
ltc_rsa_op_parameters *params);
482+
int rsa_key_valid_op(ltc_rsa_op op, ltc_rsa_op_checked *params);
445483
int rsa_params_equal(const ltc_rsa_parameters *a, const ltc_rsa_parameters *b);
446484
int rsa_make_key_bn_e(prng_state *prng, int wprng, int size, void *e,
447485
rsa_key *key); /* used by op-tee */
@@ -756,17 +794,23 @@ int pk_oid_cmp_with_asn1(const char *o1, const ltc_asn1_list *o2);
756794

757795
#ifdef LTC_PKCS_1
758796

759-
int pkcs_1_pss_encode_mgf1(const unsigned char *msghash, unsigned long msghashlen,
760-
unsigned long saltlen,
761-
prng_state *prng, int prng_idx,
762-
int hash_idx, int mgf_hash_idx,
763-
unsigned long modulus_bitlen,
764-
unsigned char *out, unsigned long *outlen);
765-
int pkcs_1_pss_decode_mgf1(const unsigned char *msghash, unsigned long msghashlen,
766-
const unsigned char *sig, unsigned long siglen,
767-
unsigned long saltlen,
768-
int hash_idx, int mgf_hash_idx,
769-
unsigned long modulus_bitlen, int *res);
797+
int ltc_pkcs_1_pss_encode_mgf1(const unsigned char *msghash, unsigned long msghashlen,
798+
ltc_rsa_op_parameters *params,
799+
unsigned long modulus_bitlen,
800+
unsigned char *out, unsigned long *outlen);
801+
int ltc_pkcs_1_pss_decode_mgf1(const unsigned char *msghash, unsigned long msghashlen,
802+
const unsigned char *sig, unsigned long siglen,
803+
ltc_rsa_op_parameters *params,
804+
unsigned long modulus_bitlen, int *res);
805+
int ltc_pkcs_1_oaep_encode(const unsigned char *msg, unsigned long msglen,
806+
unsigned long modulus_bitlen,
807+
ltc_rsa_op_parameters *params,
808+
unsigned char *out, unsigned long *outlen);
809+
int ltc_pkcs_1_oaep_decode(const unsigned char *msg, unsigned long msglen,
810+
unsigned long modulus_bitlen,
811+
ltc_rsa_op_parameters *params,
812+
unsigned char *out, unsigned long *outlen,
813+
int *res);
770814

771815
#endif /* LTC_PKCS_1 */
772816

0 commit comments

Comments
 (0)