src/src/pdkim/rsa.h

   1 /**
   2  * \file rsa.h
   3  *
   4  *  Copyright (C) 2006-2009, Paul Bakker <polarssl_maintainer at polarssl.org>
   5  *  All rights reserved.
   6  *
   7  *  Joined copyright on original XySSL code with: Christophe Devine
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License along
  20  *  with this program; if not, write to the Free Software Foundation, Inc.,
  21  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22  */
  23
  24 /* $Cambridge: exim/src/src/pdkim/rsa.h,v 1.3 2009/12/07 13:05:07 tom Exp $ */
  25
  26 #ifndef POLARSSL_RSA_H
  27 #define POLARSSL_RSA_H
  28
  29 #include "bignum.h"
  30
  31 /*
  32  * RSA Error codes
  33  */
  34 #define POLARSSL_ERR_RSA_BAD_INPUT_DATA                    -0x0400
  35 #define POLARSSL_ERR_RSA_INVALID_PADDING                   -0x0410
  36 #define POLARSSL_ERR_RSA_KEY_GEN_FAILED                    -0x0420
  37 #define POLARSSL_ERR_RSA_KEY_CHECK_FAILED                  -0x0430
  38 #define POLARSSL_ERR_RSA_PUBLIC_FAILED                     -0x0440
  39 #define POLARSSL_ERR_RSA_PRIVATE_FAILED                    -0x0450
  40 #define POLARSSL_ERR_RSA_VERIFY_FAILED                     -0x0460
  41 #define POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE                  -0x0470
  42
  43 /* *************** begin copy from x509.h  ************************/
  44 /*
  45  * ASN1 Error codes
  46  *
  47  * These error codes will be OR'ed to X509 error codes for
  48  * higher error granularity.
  49  */
  50 #define POLARSSL_ERR_ASN1_OUT_OF_DATA                      0x0014
  51 #define POLARSSL_ERR_ASN1_UNEXPECTED_TAG                   0x0016
  52 #define POLARSSL_ERR_ASN1_INVALID_LENGTH                   0x0018
  53 #define POLARSSL_ERR_ASN1_LENGTH_MISMATCH                  0x001A
  54 #define POLARSSL_ERR_ASN1_INVALID_DATA                     0x001C
  55
  56 /*
  57  * X509 Error codes
  58  */
  59 #define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE              -0x0020
  60 #define POLARSSL_ERR_X509_CERT_INVALID_PEM                 -0x0040
  61 #define POLARSSL_ERR_X509_CERT_INVALID_FORMAT              -0x0060
  62 #define POLARSSL_ERR_X509_CERT_INVALID_VERSION             -0x0080
  63 #define POLARSSL_ERR_X509_CERT_INVALID_SERIAL              -0x00A0
  64 #define POLARSSL_ERR_X509_CERT_INVALID_ALG                 -0x00C0
  65 #define POLARSSL_ERR_X509_CERT_INVALID_NAME                -0x00E0
  66 #define POLARSSL_ERR_X509_CERT_INVALID_DATE                -0x0100
  67 #define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY              -0x0120
  68 #define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE           -0x0140
  69 #define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS          -0x0160
  70 #define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION             -0x0180
  71 #define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG             -0x01A0
  72 #define POLARSSL_ERR_X509_CERT_UNKNOWN_PK_ALG              -0x01C0
  73 #define POLARSSL_ERR_X509_CERT_SIG_MISMATCH                -0x01E0
  74 #define POLARSSL_ERR_X509_CERT_VERIFY_FAILED               -0x0200
  75 #define POLARSSL_ERR_X509_KEY_INVALID_PEM                  -0x0220
  76 #define POLARSSL_ERR_X509_KEY_INVALID_VERSION              -0x0240
  77 #define POLARSSL_ERR_X509_KEY_INVALID_FORMAT               -0x0260
  78 #define POLARSSL_ERR_X509_KEY_INVALID_ENC_IV               -0x0280
  79 #define POLARSSL_ERR_X509_KEY_UNKNOWN_ENC_ALG              -0x02A0
  80 #define POLARSSL_ERR_X509_KEY_PASSWORD_REQUIRED            -0x02C0
  81 #define POLARSSL_ERR_X509_KEY_PASSWORD_MISMATCH            -0x02E0
  82 #define POLARSSL_ERR_X509_POINT_ERROR                      -0x0300
  83 #define POLARSSL_ERR_X509_VALUE_TO_LENGTH                  -0x0320
  84
  85 /*
  86  * DER constants
  87  */
  88 #define ASN1_BOOLEAN                 0x01
  89 #define ASN1_INTEGER                 0x02
  90 #define ASN1_BIT_STRING              0x03
  91 #define ASN1_OCTET_STRING            0x04
  92 #define ASN1_NULL                    0x05
  93 #define ASN1_OID                     0x06
  94 #define ASN1_UTF8_STRING             0x0C
  95 #define ASN1_SEQUENCE                0x10
  96 #define ASN1_SET                     0x11
  97 #define ASN1_PRINTABLE_STRING        0x13
  98 #define ASN1_T61_STRING              0x14
  99 #define ASN1_IA5_STRING              0x16
 100 #define ASN1_UTC_TIME                0x17
 101 #define ASN1_UNIVERSAL_STRING        0x1C
 102 #define ASN1_BMP_STRING              0x1E
 103 #define ASN1_PRIMITIVE               0x00
 104 #define ASN1_CONSTRUCTED             0x20
 105 #define ASN1_CONTEXT_SPECIFIC        0x80
 106
 107 /* ***************   end copy from x509.h  ************************/
 108
 109 /*
 110  * PKCS#1 constants
 111  */
 112 #define SIG_RSA_RAW     0
 113 #define SIG_RSA_MD2     2
 114 #define SIG_RSA_MD4     3
 115 #define SIG_RSA_MD5     4
 116 #define SIG_RSA_SHA1    5
 117 #define SIG_RSA_SHA224  14
 118 #define SIG_RSA_SHA256  11
 119 #define SIG_RSA_SHA384  12
 120 #define SIG_RSA_SHA512  13
 121
 122 #define RSA_PUBLIC      0
 123 #define RSA_PRIVATE     1
 124
 125 #define RSA_PKCS_V15    0
 126 #define RSA_PKCS_V21    1
 127
 128 #define RSA_SIGN        1
 129 #define RSA_CRYPT       2
 130
 131 #define ASN1_STR_CONSTRUCTED_SEQUENCE "\x30"
 132 #define ASN1_STR_NULL                 "\x05"
 133 #define ASN1_STR_OID                  "\x06"
 134 #define ASN1_STR_OCTET_STRING         "\x04"
 135
 136 #define OID_DIGEST_ALG_MDX            "\x2A\x86\x48\x86\xF7\x0D\x02\x00"
 137 #define OID_HASH_ALG_SHA1             "\x2b\x0e\x03\x02\x1a"
 138 #define OID_HASH_ALG_SHA2X            "\x60\x86\x48\x01\x65\x03\x04\x02\x00"
 139
 140 #define OID_ISO_MEMBER_BODIES         "\x2a"
 141 #define OID_ISO_IDENTIFIED_ORG        "\x2b"
 142
 143 /*
 144  * ISO Member bodies OID parts
 145  */
 146 #define OID_COUNTRY_US                "\x86\x48"
 147 #define OID_RSA_DATA_SECURITY         "\x86\xf7\x0d"
 148
 149 /*
 150  * ISO Identified organization OID parts
 151  */
 152 #define OID_OIW_SECSIG_SHA1           "\x0e\x03\x02\x1a"
 153
 154 /*
 155  * DigestInfo ::= SEQUENCE {
 156  *   digestAlgorithm DigestAlgorithmIdentifier,
 157  *   digest Digest }
 158  *
 159  * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
 160  *
 161  * Digest ::= OCTET STRING
 162  */
 163 #define ASN1_HASH_MDX \
 164 ( \
 165     ASN1_STR_CONSTRUCTED_SEQUENCE "\x20" \
 166     ASN1_STR_CONSTRUCTED_SEQUENCE "\x0C" \
 167     ASN1_STR_OID "\x08" \
 168     OID_DIGEST_ALG_MDX \
 169     ASN1_STR_NULL "\x00" \
 170     ASN1_STR_OCTET_STRING "\x10" \
 171 )
 172
 173 #define ASN1_HASH_SHA1 \
 174     ASN1_STR_CONSTRUCTED_SEQUENCE "\x21" \
 175     ASN1_STR_CONSTRUCTED_SEQUENCE "\x09" \
 176     ASN1_STR_OID "\x05" \
 177     OID_HASH_ALG_SHA1 \
 178     ASN1_STR_NULL "\x00" \
 179     ASN1_STR_OCTET_STRING "\x14"
 180
 181 #define ASN1_HASH_SHA2X \
 182     ASN1_STR_CONSTRUCTED_SEQUENCE "\x11" \
 183     ASN1_STR_CONSTRUCTED_SEQUENCE "\x0d" \
 184     ASN1_STR_OID "\x09" \
 185     OID_HASH_ALG_SHA2X \
 186     ASN1_STR_NULL "\x00" \
 187     ASN1_STR_OCTET_STRING "\x00"
 188
 189 /**
 190  * \brief          RSA context structure
 191  */
 192 typedef struct
 193 {
 194     int ver;                    /*!<  always 0          */
 195     int len;                    /*!<  size(N) in chars  */
 196
 197     mpi N;                      /*!<  public modulus    */
 198     mpi E;                      /*!<  public exponent   */
 199
 200     mpi D;                      /*!<  private exponent  */
 201     mpi P;                      /*!<  1st prime factor  */
 202     mpi Q;                      /*!<  2nd prime factor  */
 203     mpi DP;                     /*!<  D % (P - 1)       */
 204     mpi DQ;                     /*!<  D % (Q - 1)       */
 205     mpi QP;                     /*!<  1 / (Q % P)       */
 206
 207     mpi RN;                     /*!<  cached R^2 mod N  */
 208     mpi RP;                     /*!<  cached R^2 mod P  */
 209     mpi RQ;                     /*!<  cached R^2 mod Q  */
 210
 211     int padding;                /*!<  1.5 or OAEP/PSS   */
 212     int hash_id;                /*!<  hash identifier   */
 213     int (*f_rng)(void *);       /*!<  RNG function      */
 214     void *p_rng;                /*!<  RNG parameter     */
 215 }
 216 rsa_context;
 217
 218 #ifdef __cplusplus
 219 extern "C" {
 220 #endif
 221
 222 /**
 223  * \brief          Initialize an RSA context
 224  *
 225  * \param ctx      RSA context to be initialized
 226  * \param padding  RSA_PKCS_V15 or RSA_PKCS_V21
 227  * \param hash_id  RSA_PKCS_V21 hash identifier
 228  * \param f_rng    RNG function
 229  * \param p_rng    RNG parameter
 230  *
 231  * \note           The hash_id parameter is actually ignored
 232  *                 when using RSA_PKCS_V15 padding.
 233  *
 234  * \note           Currently (xyssl-0.8), RSA_PKCS_V21 padding
 235  *                 is not supported.
 236  */
 237 void rsa_init( rsa_context *ctx,
 238                int padding,
 239                int hash_id,
 240                int (*f_rng)(void *),
 241                void *p_rng );
 242
 243 /**
 244  * \brief          Generate an RSA keypair
 245  *
 246  * \param ctx      RSA context that will hold the key
 247  * \param nbits    size of the public key in bits
 248  * \param exponent public exponent (e.g., 65537)
 249  *
 250  * \note           rsa_init() must be called beforehand to setup
 251  *                 the RSA context (especially f_rng and p_rng).
 252  *
 253  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 254  */
 255 int rsa_gen_key( rsa_context *ctx, int nbits, int exponent );
 256
 257 /**
 258  * \brief          Check a public RSA key
 259  *
 260  * \param ctx      RSA context to be checked
 261  *
 262  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 263  */
 264 int rsa_check_pubkey( rsa_context *ctx );
 265
 266 /**
 267  * \brief          Check a private RSA key
 268  *
 269  * \param ctx      RSA context to be checked
 270  *
 271  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 272  */
 273 int rsa_check_privkey( rsa_context *ctx );
 274
 275 /**
 276  * \brief          Do an RSA public key operation
 277  *
 278  * \param ctx      RSA context
 279  * \param input    input buffer
 280  * \param output   output buffer
 281  *
 282  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 283  *
 284  * \note           This function does NOT take care of message
 285  *                 padding. Also, be sure to set input[0] = 0 or assure that
 286  *                 input is smaller than N.
 287  *
 288  * \note           The input and output buffers must be large
 289  *                 enough (eg. 128 bytes if RSA-1024 is used).
 290  */
 291 int rsa_public( rsa_context *ctx,
 292                 unsigned char *input,
 293                 unsigned char *output );
 294
 295 /**
 296  * \brief          Do an RSA private key operation
 297  *
 298  * \param ctx      RSA context
 299  * \param input    input buffer
 300  * \param output   output buffer
 301  *
 302  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 303  *
 304  * \note           The input and output buffers must be large
 305  *                 enough (eg. 128 bytes if RSA-1024 is used).
 306  */
 307 int rsa_private( rsa_context *ctx,
 308                  unsigned char *input,
 309                  unsigned char *output );
 310
 311 /**
 312  * \brief          Add the message padding, then do an RSA operation
 313  *
 314  * \param ctx      RSA context
 315  * \param mode     RSA_PUBLIC or RSA_PRIVATE
 316  * \param ilen     contains the plaintext length
 317  * \param input    buffer holding the data to be encrypted
 318  * \param output   buffer that will hold the ciphertext
 319  *
 320  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 321  *
 322  * \note           The output buffer must be as large as the size
 323  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used).
 324  */
 325 int rsa_pkcs1_encrypt( rsa_context *ctx,
 326                        int mode, int  ilen,
 327                        unsigned char *input,
 328                        unsigned char *output );
 329
 330 /**
 331  * \brief          Do an RSA operation, then remove the message padding
 332  *
 333  * \param ctx      RSA context
 334  * \param mode     RSA_PUBLIC or RSA_PRIVATE
 335  * \param input    buffer holding the encrypted data
 336  * \param output   buffer that will hold the plaintext
 337  * \param olen     will contain the plaintext length
 338  * \param output_max_len  maximum length of the output buffer
 339  *
 340  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
 341  *
 342  * \note           The output buffer must be as large as the size
 343  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
 344  *                 an error is thrown.
 345  */
 346 int rsa_pkcs1_decrypt( rsa_context *ctx,
 347                        int mode, int *olen,
 348                        unsigned char *input,
 349                        unsigned char *output,
 350                        int output_max_len );
 351
 352 /**
 353  * \brief          Do a private RSA to sign a message digest
 354  *
 355  * \param ctx      RSA context
 356  * \param mode     RSA_PUBLIC or RSA_PRIVATE
 357  * \param hash_id  SIG_RSA_RAW, SIG_RSA_MD{2,4,5} or SIG_RSA_SHA{1,224,256,384,512}
 358  * \param hashlen  message digest length (for SIG_RSA_RAW only)
 359  * \param hash     buffer holding the message digest
 360  * \param sig      buffer that will hold the ciphertext
 361  *
 362  * \return         0 if the signing operation was successful,
 363  *                 or an POLARSSL_ERR_RSA_XXX error code
 364  *
 365  * \note           The "sig" buffer must be as large as the size
 366  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used).
 367  */
 368 int rsa_pkcs1_sign( rsa_context *ctx,
 369                     int mode,
 370                     int hash_id,
 371                     int hashlen,
 372                     unsigned char *hash,
 373                     unsigned char *sig );
 374
 375 /**
 376  * \brief          Do a public RSA and check the message digest
 377  *
 378  * \param ctx      points to an RSA public key
 379  * \param mode     RSA_PUBLIC or RSA_PRIVATE
 380  * \param hash_id  SIG_RSA_RAW, RSA_MD{2,4,5} or RSA_SHA{1,256}
 381  * \param hashlen  message digest length (for SIG_RSA_RAW only)
 382  * \param hash     buffer holding the message digest
 383  * \param sig      buffer holding the ciphertext
 384  *
 385  * \return         0 if the verify operation was successful,
 386  *                 or an POLARSSL_ERR_RSA_XXX error code
 387  *
 388  * \note           The "sig" buffer must be as large as the size
 389  *                 of ctx->N (eg. 128 bytes if RSA-1024 is used).
 390  */
 391 int rsa_pkcs1_verify( rsa_context *ctx,
 392                       int mode,
 393                       int hash_id,
 394                       int hashlen,
 395                       unsigned char *hash,
 396                       unsigned char *sig );
 397
 398 /**
 399  * \brief          Free the components of an RSA key
 400  *
 401  * \param ctx      RSA Context to free
 402  */
 403 void rsa_free( rsa_context *ctx );
 404
 405 int rsa_parse_public_key( rsa_context *rsa, unsigned char *buf, int buflen );
 406
 407 int rsa_parse_key( rsa_context *rsa, unsigned char *buf, int buflen,
 408                                      unsigned char *pwd, int pwdlen );
 409
 410 #ifdef __cplusplus
 411 }
 412 #endif
 413
 414 #endif /* rsa.h */