summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/rsa/rsa_oaep.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/rsa/rsa_oaep.c')
-rw-r--r--src/lib/libcrypto/rsa/rsa_oaep.c236
1 files changed, 0 insertions, 236 deletions
diff --git a/src/lib/libcrypto/rsa/rsa_oaep.c b/src/lib/libcrypto/rsa/rsa_oaep.c
deleted file mode 100644
index 86e2bfc34f..0000000000
--- a/src/lib/libcrypto/rsa/rsa_oaep.c
+++ /dev/null
@@ -1,236 +0,0 @@
1/* $OpenBSD: rsa_oaep.c,v 1.25 2015/06/20 12:01:14 jsing Exp $ */
2/* Written by Ulf Moeller. This software is distributed on an "AS IS"
3 basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. */
4
5/* EME-OAEP as defined in RFC 2437 (PKCS #1 v2.0) */
6
7/* See Victor Shoup, "OAEP reconsidered," Nov. 2000,
8 * <URL: http://www.shoup.net/papers/oaep.ps.Z>
9 * for problems with the security proof for the
10 * original OAEP scheme, which EME-OAEP is based on.
11 *
12 * A new proof can be found in E. Fujisaki, T. Okamoto,
13 * D. Pointcheval, J. Stern, "RSA-OEAP is Still Alive!",
14 * Dec. 2000, <URL: http://eprint.iacr.org/2000/061/>.
15 * The new proof has stronger requirements for the
16 * underlying permutation: "partial-one-wayness" instead
17 * of one-wayness. For the RSA function, this is
18 * an equivalent notion.
19 */
20
21#include <stdio.h>
22#include <stdlib.h>
23#include <string.h>
24
25#include <openssl/opensslconf.h>
26
27#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
28
29#include <openssl/bn.h>
30#include <openssl/err.h>
31#include <openssl/evp.h>
32#include <openssl/rsa.h>
33#include <openssl/sha.h>
34
35static int MGF1(unsigned char *mask, long len, const unsigned char *seed,
36 long seedlen);
37
38int
39RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
40 const unsigned char *from, int flen, const unsigned char *param, int plen)
41{
42 int i, emlen = tlen - 1;
43 unsigned char *db, *seed;
44 unsigned char *dbmask, seedmask[SHA_DIGEST_LENGTH];
45
46 if (flen > emlen - 2 * SHA_DIGEST_LENGTH - 1) {
47 RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,
48 RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
49 return 0;
50 }
51
52 if (emlen < 2 * SHA_DIGEST_LENGTH + 1) {
53 RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,
54 RSA_R_KEY_SIZE_TOO_SMALL);
55 return 0;
56 }
57
58 to[0] = 0;
59 seed = to + 1;
60 db = to + SHA_DIGEST_LENGTH + 1;
61
62 if (!EVP_Digest((void *)param, plen, db, NULL, EVP_sha1(), NULL))
63 return 0;
64 memset(db + SHA_DIGEST_LENGTH, 0,
65 emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
66 db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
67 memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, flen);
68 arc4random_buf(seed, SHA_DIGEST_LENGTH);
69
70 dbmask = malloc(emlen - SHA_DIGEST_LENGTH);
71 if (dbmask == NULL) {
72 RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
73 return 0;
74 }
75
76 if (MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed,
77 SHA_DIGEST_LENGTH) < 0)
78 return 0;
79 for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
80 db[i] ^= dbmask[i];
81
82 if (MGF1(seedmask, SHA_DIGEST_LENGTH, db,
83 emlen - SHA_DIGEST_LENGTH) < 0)
84 return 0;
85 for (i = 0; i < SHA_DIGEST_LENGTH; i++)
86 seed[i] ^= seedmask[i];
87
88 free(dbmask);
89 return 1;
90}
91
92int
93RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
94 const unsigned char *from, int flen, int num, const unsigned char *param,
95 int plen)
96{
97 int i, dblen, mlen = -1;
98 const unsigned char *maskeddb;
99 int lzero;
100 unsigned char *db = NULL;
101 unsigned char seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];
102 unsigned char *padded_from;
103 int bad = 0;
104
105 if (--num < 2 * SHA_DIGEST_LENGTH + 1)
106 /*
107 * 'num' is the length of the modulus, i.e. does not depend
108 * on the particular ciphertext.
109 */
110 goto decoding_err;
111
112 lzero = num - flen;
113 if (lzero < 0) {
114 /*
115 * signalling this error immediately after detection might allow
116 * for side-channel attacks (e.g. timing if 'plen' is huge
117 * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA
118 * Optimal Asymmetric Encryption Padding (OAEP) [...]",
119 * CRYPTO 2001), so we use a 'bad' flag
120 */
121 bad = 1;
122 lzero = 0;
123 flen = num; /* don't overflow the memcpy to padded_from */
124 }
125
126 dblen = num - SHA_DIGEST_LENGTH;
127 db = malloc(dblen + num);
128 if (db == NULL) {
129 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP,
130 ERR_R_MALLOC_FAILURE);
131 return -1;
132 }
133
134 /*
135 * Always do this zero-padding copy (even when lzero == 0)
136 * to avoid leaking timing info about the value of lzero.
137 */
138 padded_from = db + dblen;
139 memset(padded_from, 0, lzero);
140 memcpy(padded_from + lzero, from, flen);
141
142 maskeddb = padded_from + SHA_DIGEST_LENGTH;
143
144 if (MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen))
145 return -1;
146 for (i = 0; i < SHA_DIGEST_LENGTH; i++)
147 seed[i] ^= padded_from[i];
148
149 if (MGF1(db, dblen, seed, SHA_DIGEST_LENGTH))
150 return -1;
151 for (i = 0; i < dblen; i++)
152 db[i] ^= maskeddb[i];
153
154 if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL))
155 return -1;
156
157 if (timingsafe_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
158 goto decoding_err;
159 else {
160 for (i = SHA_DIGEST_LENGTH; i < dblen; i++)
161 if (db[i] != 0x00)
162 break;
163 if (i == dblen || db[i] != 0x01)
164 goto decoding_err;
165 else {
166 /* everything looks OK */
167
168 mlen = dblen - ++i;
169 if (tlen < mlen) {
170 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP,
171 RSA_R_DATA_TOO_LARGE);
172 mlen = -1;
173 } else
174 memcpy(to, db + i, mlen);
175 }
176 }
177 free(db);
178 return mlen;
179
180decoding_err:
181 /*
182 * To avoid chosen ciphertext attacks, the error message should not
183 * reveal which kind of decoding error happened
184 */
185 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_OAEP_DECODING_ERROR);
186 free(db);
187 return -1;
188}
189
190int
191PKCS1_MGF1(unsigned char *mask, long len, const unsigned char *seed,
192 long seedlen, const EVP_MD *dgst)
193{
194 long i, outlen = 0;
195 unsigned char cnt[4];
196 EVP_MD_CTX c;
197 unsigned char md[EVP_MAX_MD_SIZE];
198 int mdlen;
199 int rv = -1;
200
201 EVP_MD_CTX_init(&c);
202 mdlen = EVP_MD_size(dgst);
203 if (mdlen < 0)
204 goto err;
205 for (i = 0; outlen < len; i++) {
206 cnt[0] = (unsigned char)((i >> 24) & 255);
207 cnt[1] = (unsigned char)((i >> 16) & 255);
208 cnt[2] = (unsigned char)((i >> 8)) & 255;
209 cnt[3] = (unsigned char)(i & 255);
210 if (!EVP_DigestInit_ex(&c, dgst, NULL) ||
211 !EVP_DigestUpdate(&c, seed, seedlen) ||
212 !EVP_DigestUpdate(&c, cnt, 4))
213 goto err;
214 if (outlen + mdlen <= len) {
215 if (!EVP_DigestFinal_ex(&c, mask + outlen, NULL))
216 goto err;
217 outlen += mdlen;
218 } else {
219 if (!EVP_DigestFinal_ex(&c, md, NULL))
220 goto err;
221 memcpy(mask + outlen, md, len - outlen);
222 outlen = len;
223 }
224 }
225 rv = 0;
226err:
227 EVP_MD_CTX_cleanup(&c);
228 return rv;
229}
230
231static int
232MGF1(unsigned char *mask, long len, const unsigned char *seed, long seedlen)
233{
234 return PKCS1_MGF1(mask, len, seed, seedlen, EVP_sha1());
235}
236#endif
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-07 20:37:36 +0000