2 * The RSA public-key cryptosystem
4 * Based on XySSL: Copyright (C) 2006-2008 Christophe Devine
6 * Copyright (C) 2009 Paul Bakker <polarssl_maintainer at polarssl dot org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman.
25 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf
26 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf
29 /* $Cambridge: exim/src/src/pdkim/rsa.c,v 1.2 2009/06/10 07:34:05 tom Exp $ */
40 * ASN.1 DER decoding routines
42 static int asn1_get_len( unsigned char **p
,
46 if( ( end
- *p
) < 1 )
47 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
49 if( ( **p
& 0x80 ) == 0 )
56 if( ( end
- *p
) < 2 )
57 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
64 if( ( end
- *p
) < 3 )
65 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
67 *len
= ( (*p
)[1] << 8 ) | (*p
)[2];
72 return( POLARSSL_ERR_ASN1_INVALID_LENGTH
);
77 if( *len
> (int) ( end
- *p
) )
78 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
83 static int asn1_get_tag( unsigned char **p
,
87 if( ( end
- *p
) < 1 )
88 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
91 return( POLARSSL_ERR_ASN1_UNEXPECTED_TAG
);
95 return( asn1_get_len( p
, end
, len
) );
98 static int asn1_get_int( unsigned char **p
,
104 if( ( ret
= asn1_get_tag( p
, end
, &len
, ASN1_INTEGER
) ) != 0 )
107 if( len
> (int) sizeof( int ) || ( **p
& 0x80 ) != 0 )
108 return( POLARSSL_ERR_ASN1_INVALID_LENGTH
);
114 *val
= ( *val
<< 8 ) | **p
;
121 static int asn1_get_mpi( unsigned char **p
,
127 if( ( ret
= asn1_get_tag( p
, end
, &len
, ASN1_INTEGER
) ) != 0 )
130 ret
= mpi_read_binary( X
, *p
, len
);
139 * Initialize an RSA context
141 void rsa_init( rsa_context
*ctx
,
144 int (*f_rng
)(void *),
147 memset( ctx
, 0, sizeof( rsa_context
) );
149 ctx
->padding
= padding
;
150 ctx
->hash_id
= hash_id
;
158 * Check a public RSA key
160 int rsa_check_pubkey( rsa_context
*ctx
)
162 if( ( ctx
->N
.p
[0] & 1 ) == 0 ||
163 ( ctx
->E
.p
[0] & 1 ) == 0 )
164 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
166 if( mpi_msb( &ctx
->N
) < 128 ||
167 mpi_msb( &ctx
->N
) > 4096 )
168 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
170 if( mpi_msb( &ctx
->E
) < 2 ||
171 mpi_msb( &ctx
->E
) > 64 )
172 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
178 * Check a private RSA key
180 int rsa_check_privkey( rsa_context
*ctx
)
183 mpi PQ
, DE
, P1
, Q1
, H
, I
, G
;
185 if( ( ret
= rsa_check_pubkey( ctx
) ) != 0 )
188 mpi_init( &PQ
, &DE
, &P1
, &Q1
, &H
, &I
, &G
, NULL
);
190 MPI_CHK( mpi_mul_mpi( &PQ
, &ctx
->P
, &ctx
->Q
) );
191 MPI_CHK( mpi_mul_mpi( &DE
, &ctx
->D
, &ctx
->E
) );
192 MPI_CHK( mpi_sub_int( &P1
, &ctx
->P
, 1 ) );
193 MPI_CHK( mpi_sub_int( &Q1
, &ctx
->Q
, 1 ) );
194 MPI_CHK( mpi_mul_mpi( &H
, &P1
, &Q1
) );
195 MPI_CHK( mpi_mod_mpi( &I
, &DE
, &H
) );
196 MPI_CHK( mpi_gcd( &G
, &ctx
->E
, &H
) );
198 if( mpi_cmp_mpi( &PQ
, &ctx
->N
) == 0 &&
199 mpi_cmp_int( &I
, 1 ) == 0 &&
200 mpi_cmp_int( &G
, 1 ) == 0 )
202 mpi_free( &G
, &I
, &H
, &Q1
, &P1
, &DE
, &PQ
, NULL
);
208 mpi_free( &G
, &I
, &H
, &Q1
, &P1
, &DE
, &PQ
, NULL
);
209 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
| ret
);
213 * Do an RSA public key operation
215 int rsa_public( rsa_context
*ctx
,
216 unsigned char *input
,
217 unsigned char *output
)
222 mpi_init( &T
, NULL
);
224 MPI_CHK( mpi_read_binary( &T
, input
, ctx
->len
) );
226 if( mpi_cmp_mpi( &T
, &ctx
->N
) >= 0 )
228 mpi_free( &T
, NULL
);
229 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
233 MPI_CHK( mpi_exp_mod( &T
, &T
, &ctx
->E
, &ctx
->N
, &ctx
->RN
) );
234 MPI_CHK( mpi_write_binary( &T
, output
, olen
) );
238 mpi_free( &T
, NULL
);
241 return( POLARSSL_ERR_RSA_PUBLIC_FAILED
| ret
);
247 * Do an RSA private key operation
249 int rsa_private( rsa_context
*ctx
,
250 unsigned char *input
,
251 unsigned char *output
)
256 mpi_init( &T
, &T1
, &T2
, NULL
);
258 MPI_CHK( mpi_read_binary( &T
, input
, ctx
->len
) );
260 if( mpi_cmp_mpi( &T
, &ctx
->N
) >= 0 )
262 mpi_free( &T
, NULL
);
263 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
267 MPI_CHK( mpi_exp_mod( &T
, &T
, &ctx
->D
, &ctx
->N
, &ctx
->RN
) );
270 * faster decryption using the CRT
272 * T1 = input ^ dP mod P
273 * T2 = input ^ dQ mod Q
275 MPI_CHK( mpi_exp_mod( &T1
, &T
, &ctx
->DP
, &ctx
->P
, &ctx
->RP
) );
276 MPI_CHK( mpi_exp_mod( &T2
, &T
, &ctx
->DQ
, &ctx
->Q
, &ctx
->RQ
) );
279 * T = (T1 - T2) * (Q^-1 mod P) mod P
281 MPI_CHK( mpi_sub_mpi( &T
, &T1
, &T2
) );
282 MPI_CHK( mpi_mul_mpi( &T1
, &T
, &ctx
->QP
) );
283 MPI_CHK( mpi_mod_mpi( &T
, &T1
, &ctx
->P
) );
286 * output = T2 + T * Q
288 MPI_CHK( mpi_mul_mpi( &T1
, &T
, &ctx
->Q
) );
289 MPI_CHK( mpi_add_mpi( &T
, &T2
, &T1
) );
293 MPI_CHK( mpi_write_binary( &T
, output
, olen
) );
297 mpi_free( &T
, &T1
, &T2
, NULL
);
300 return( POLARSSL_ERR_RSA_PRIVATE_FAILED
| ret
);
306 * Add the message padding, then do an RSA operation
308 int rsa_pkcs1_encrypt( rsa_context
*ctx
,
310 unsigned char *input
,
311 unsigned char *output
)
314 unsigned char *p
= output
;
318 switch( ctx
->padding
)
322 if( ilen
< 0 || olen
< ilen
+ 11 )
323 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
325 nb_pad
= olen
- 3 - ilen
;
330 while( nb_pad
-- > 0 )
333 *p
= (unsigned char) rand();
338 memcpy( p
, input
, ilen
);
343 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
346 return( ( mode
== RSA_PUBLIC
)
347 ? rsa_public( ctx
, output
, output
)
348 : rsa_private( ctx
, output
, output
) );
352 * Do an RSA operation, then remove the message padding
354 int rsa_pkcs1_decrypt( rsa_context
*ctx
,
356 unsigned char *input
,
357 unsigned char *output
,
362 unsigned char buf
[512];
366 if( ilen
< 16 || ilen
> (int) sizeof( buf
) )
367 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
369 ret
= ( mode
== RSA_PUBLIC
)
370 ? rsa_public( ctx
, input
, buf
)
371 : rsa_private( ctx
, input
, buf
);
378 switch( ctx
->padding
)
382 if( *p
++ != 0 || *p
++ != RSA_CRYPT
)
383 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
387 if( p
>= buf
+ ilen
- 1 )
388 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
396 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
399 if (ilen
- (int)(p
- buf
) > output_max_len
)
400 return( POLARSSL_ERR_RSA_OUTPUT_TO_LARGE
);
402 *olen
= ilen
- (int)(p
- buf
);
403 memcpy( output
, p
, *olen
);
409 * Do an RSA operation to sign the message digest
411 int rsa_pkcs1_sign( rsa_context
*ctx
,
419 unsigned char *p
= sig
;
423 switch( ctx
->padding
)
430 nb_pad
= olen
- 3 - hashlen
;
436 nb_pad
= olen
- 3 - 16 - 18;
440 nb_pad
= olen
- 3 - 20 - 15;
444 nb_pad
= olen
- 3 - 32 - 19;
448 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
452 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
456 memset( p
, 0xFF, nb_pad
);
463 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
469 memcpy( p
, hash
, hashlen
);
473 memcpy( p
, ASN1_HASH_MDX
, 18 );
474 memcpy( p
+ 18, hash
, 16 );
478 memcpy( p
, ASN1_HASH_MDX
, 18 );
479 memcpy( p
+ 18, hash
, 16 );
483 memcpy( p
, ASN1_HASH_MDX
, 18 );
484 memcpy( p
+ 18, hash
, 16 );
488 memcpy( p
, ASN1_HASH_SHA1
, 15 );
489 memcpy( p
+ 15, hash
, 20 );
493 memcpy( p
, ASN1_HASH_SHA256
, 19 );
494 memcpy( p
+ 19, hash
, 32 );
498 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
501 return( ( mode
== RSA_PUBLIC
)
502 ? rsa_public( ctx
, sig
, sig
)
503 : rsa_private( ctx
, sig
, sig
) );
507 * Do an RSA operation and check the message digest
509 int rsa_pkcs1_verify( rsa_context
*ctx
,
516 int ret
, len
, siglen
;
518 unsigned char buf
[512];
522 if( siglen
< 16 || siglen
> (int) sizeof( buf
) )
523 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
525 ret
= ( mode
== RSA_PUBLIC
)
526 ? rsa_public( ctx
, sig
, buf
)
527 : rsa_private( ctx
, sig
, buf
);
534 switch( ctx
->padding
)
538 if( *p
++ != 0 || *p
++ != RSA_SIGN
)
539 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
543 if( p
>= buf
+ siglen
- 1 || *p
!= 0xFF )
544 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
552 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
555 len
= siglen
- (int)( p
- buf
);
562 if( memcmp( p
, ASN1_HASH_MDX
, 18 ) != 0 )
563 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
565 if( ( c
== 2 && hash_id
== RSA_MD2
) ||
566 ( c
== 4 && hash_id
== RSA_MD4
) ||
567 ( c
== 5 && hash_id
== RSA_MD5
) )
569 if( memcmp( p
+ 18, hash
, 16 ) == 0 )
572 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
576 if( len
== 35 && hash_id
== RSA_SHA1
)
578 if( memcmp( p
, ASN1_HASH_SHA1
, 15 ) == 0 &&
579 memcmp( p
+ 15, hash
, 20 ) == 0 )
582 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
585 if( len
== 51 && hash_id
== RSA_SHA256
)
587 if( memcmp( p
, ASN1_HASH_SHA256
, 19 ) == 0 &&
588 memcmp( p
+ 19, hash
, 32 ) == 0 )
591 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
594 if( len
== hashlen
&& hash_id
== RSA_RAW
)
596 if( memcmp( p
, hash
, hashlen
) == 0 )
599 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
602 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
606 * Free the components of an RSA key
608 void rsa_free( rsa_context
*ctx
)
610 mpi_free( &ctx
->RQ
, &ctx
->RP
, &ctx
->RN
,
611 &ctx
->QP
, &ctx
->DQ
, &ctx
->DP
,
612 &ctx
->Q
, &ctx
->P
, &ctx
->D
,
613 &ctx
->E
, &ctx
->N
, NULL
);
618 * Parse a public RSA key
620 OpenSSL RSA public key ASN1 container
621 0:d=0 hl=3 l= 159 cons: SEQUENCE
622 3:d=1 hl=2 l= 13 cons: SEQUENCE
623 5:d=2 hl=2 l= 9 prim: OBJECT:rsaEncryption
624 16:d=2 hl=2 l= 0 prim: NULL
625 18:d=1 hl=3 l= 141 prim: BIT STRING:RSAPublicKey (below)
627 RSAPublicKey ASN1 container
628 0:d=0 hl=3 l= 137 cons: SEQUENCE
629 3:d=1 hl=3 l= 129 prim: INTEGER:Public modulus
630 135:d=1 hl=2 l= 3 prim: INTEGER:Public exponent
633 int rsa_parse_public_key( rsa_context
*rsa
, unsigned char *buf
, int buflen
)
635 unsigned char *p
, *end
;
641 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
642 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 ) {
643 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
646 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
647 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) == 0 ) {
648 /* Skip over embedded rsaEncryption Object */
651 /* The RSAPublicKey ASN1 container is wrapped in a BIT STRING */
652 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
653 ASN1_BIT_STRING
) ) != 0 ) {
654 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
657 /* Limit range to that BIT STRING */
661 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
662 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 ) {
663 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
667 if ( ( ( ret
= asn1_get_mpi( &p
, end
, &(rsa
->N
) ) ) == 0 ) &&
668 ( ( ret
= asn1_get_mpi( &p
, end
, &(rsa
->E
) ) ) == 0 ) ) {
669 rsa
->len
= mpi_size( &rsa
->N
);
673 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
677 * Parse a private RSA key
679 int rsa_parse_key( rsa_context
*rsa
, unsigned char *buf
, int buflen
,
680 unsigned char *pwd
, int pwdlen
)
683 unsigned char *s1
, *s2
;
684 unsigned char *p
, *end
;
686 s1
= (unsigned char *) strstr( (char *) buf
,
687 "-----BEGIN RSA PRIVATE KEY-----" );
691 s2
= (unsigned char *) strstr( (char *) buf
,
692 "-----END RSA PRIVATE KEY-----" );
694 if( s2
== NULL
|| s2
<= s1
)
695 return( POLARSSL_ERR_X509_KEY_INVALID_PEM
);
698 if( *s1
== '\r' ) s1
++;
699 if( *s1
== '\n' ) s1
++;
700 else return( POLARSSL_ERR_X509_KEY_INVALID_PEM
);
704 if( memcmp( s1
, "Proc-Type: 4,ENCRYPTED", 22 ) == 0 )
706 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
);
710 ret
= base64_decode( NULL
, &len
, s1
, s2
- s1
);
712 if( ret
== POLARSSL_ERR_BASE64_INVALID_CHARACTER
)
713 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_PEM
);
715 if( ( buf
= (unsigned char *) malloc( len
) ) == NULL
)
718 if( ( ret
= base64_decode( buf
, &len
, s1
, s2
- s1
) ) != 0 )
721 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_PEM
);
728 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
);
732 memset( rsa
, 0, sizeof( rsa_context
) );
738 * RSAPrivateKey ::= SEQUENCE {
740 * modulus INTEGER, -- n
741 * publicExponent INTEGER, -- e
742 * privateExponent INTEGER, -- d
743 * prime1 INTEGER, -- p
744 * prime2 INTEGER, -- q
745 * exponent1 INTEGER, -- d mod (p-1)
746 * exponent2 INTEGER, -- d mod (q-1)
747 * coefficient INTEGER, -- (inverse of q) mod p
748 * otherPrimeInfos OtherPrimeInfos OPTIONAL
751 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
752 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 )
758 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
763 if( ( ret
= asn1_get_int( &p
, end
, &rsa
->ver
) ) != 0 )
769 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
778 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_VERSION
);
781 if( ( ret
= asn1_get_mpi( &p
, end
, &rsa
->N
) ) != 0 ||
782 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->E
) ) != 0 ||
783 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->D
) ) != 0 ||
784 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->P
) ) != 0 ||
785 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->Q
) ) != 0 ||
786 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->DP
) ) != 0 ||
787 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->DQ
) ) != 0 ||
788 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->QP
) ) != 0 )
794 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_FORMAT
);
797 rsa
->len
= mpi_size( &rsa
->N
);
805 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
|
806 POLARSSL_ERR_ASN1_LENGTH_MISMATCH
);
809 if( ( ret
= rsa_check_privkey( rsa
) ) != 0 )