kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
96e744c176
boringssl/crypto/rsa/padding.c

709 lines
18 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 2005.
*/
/* ====================================================================
* Copyright (c) 2005 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#include <openssl/rsa.h>
Don't compare signed vs. unsigned. This resolves a pile of MSVC warnings in Chromium. Change-Id: Ib9a29cb88d8ed8ec4118d153260f775be059a803 Reviewed-on: https://boringssl-review.googlesource.com/1865 Reviewed-by: Adam Langley <agl@google.com>
2014-10-01 02:00:38 +01:00
#include <assert.h>
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
#include <limits.h>
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-31 01:08:37 +00:00
#include <string.h>
Don't compare signed vs. unsigned. This resolves a pile of MSVC warnings in Chromium. Change-Id: Ib9a29cb88d8ed8ec4118d153260f775be059a803 Reviewed-on: https://boringssl-review.googlesource.com/1865 Reviewed-by: Adam Langley <agl@google.com>
2014-10-01 02:00:38 +01:00
Move all signature algorithm code to crypto/x509. All the signature algorithm logic depends on X509_ALGOR. This also removes the X509_ALGOR-based EVP functions which are no longer used externally. I think those APIs were a mistake on my part. The use in Chromium was unnecessary (and has since been removed anyway). The new X.509 stack will want to process the signatureAlgorithm itself to be able to enforce policies on it. This also moves the RSA_PSS_PARAMS bits to crypto/x509 from crypto/rsa. That struct is also tied to crypto/x509. Any new RSA-PSS code would have to use something else anyway. BUG=499653 Change-Id: I6c4b4573b2800a2e0f863d35df94d048864b7c41 Reviewed-on: https://boringssl-review.googlesource.com/7025 Reviewed-by: Adam Langley <agl@google.com>
2016-01-30 19:58:52 +00:00
#include <openssl/bn.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/digest.h>
#include <openssl/err.h>
#include <openssl/mem.h>
#include <openssl/rand.h>
#include <openssl/sha.h>
#include "internal.h"
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
#include "../internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* TODO(fork): don't the check functions have to be constant time? */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_add_PKCS1_type_1(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
unsigned j;
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (to_len < RSA_PKCS1_PADDING_SIZE) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
return 0;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len > to_len - RSA_PKCS1_PADDING_SIZE) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Remove unnecessary type casts in crypto/rsa. Change-Id: I0b5c661674fbcaf6b4d5b0ce7944459cd45606b1 Reviewed-on: https://boringssl-review.googlesource.com/7466 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-15 23:00:49 +00:00
uint8_t *p = to;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
*(p++) = 0;
*(p++) = 1; /* Private Key BT (Block Type) */
/* pad out with 0xff data */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
j = to_len - 3 - from_len;
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(p, 0xff, j);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
p += j;
*(p++) = 0;
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(p, from, from_len);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_check_PKCS1_type_1(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
unsigned i, j;
const uint8_t *p;
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len < 2) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_SMALL);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
p = from;
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
if ((*(p++) != 0) || (*(p++) != 1)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_BLOCK_TYPE_IS_NOT_01);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
/* scan over padding data */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
j = from_len - 2; /* one for leading 00, one for type. */
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
for (i = 0; i < j; i++) {
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
/* should decrypt to 0xff */
if (*p != 0xff) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (*p == 0) {
p++;
break;
} else {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_FIXED_HEADER_DECRYPT);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
}
p++;
}
if (i == j) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_NULL_BEFORE_BLOCK_MISSING);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
if (i < 8) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_PAD_BYTE_COUNT);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
i++; /* Skip over the '\0' */
j -= i;
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (j > to_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(to, p, j);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return j;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_add_PKCS1_type_2(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
unsigned i, j;
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (to_len < RSA_PKCS1_PADDING_SIZE) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
return 0;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len > to_len - RSA_PKCS1_PADDING_SIZE) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Remove unnecessary type casts in crypto/rsa. Change-Id: I0b5c661674fbcaf6b4d5b0ce7944459cd45606b1 Reviewed-on: https://boringssl-review.googlesource.com/7466 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-15 23:00:49 +00:00
uint8_t *p = to;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
*(p++) = 0;
*(p++) = 2; /* Public Key BT (Block Type) */
/* pad out with non-zero random data */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
j = to_len - 3 - from_len;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Consistently use RAND_bytes and check for failure. RAND_pseudo_bytes just calls RAND_bytes now and only returns 0 or 1. Switch all callers within the library call the new one and use the simpler failure check. This fixes a few error checks that no longer work (< 0) and some missing ones. Change-Id: Id51c79deec80075949f73fa1fbd7b76aac5570c6 Reviewed-on: https://boringssl-review.googlesource.com/2621 Reviewed-by: Adam Langley <agl@google.com>
2014-12-16 12:48:10 +00:00
if (!RAND_bytes(p, j)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
for (i = 0; i < j; i++) {
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
while (*p == 0) {
Consistently use RAND_bytes and check for failure. RAND_pseudo_bytes just calls RAND_bytes now and only returns 0 or 1. Switch all callers within the library call the new one and use the simpler failure check. This fixes a few error checks that no longer work (< 0) and some missing ones. Change-Id: Id51c79deec80075949f73fa1fbd7b76aac5570c6 Reviewed-on: https://boringssl-review.googlesource.com/2621 Reviewed-by: Adam Langley <agl@google.com>
2014-12-16 12:48:10 +00:00
if (!RAND_bytes(p, 1)) {
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
p++;
}
*(p++) = 0;
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(p, from, from_len);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_check_PKCS1_type_2(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len) {
if (from_len == 0) {
OPENSSL_PUT_ERROR(RSA, RSA_R_EMPTY_PUBLIC_KEY);
return -1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
/* PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography
* Standard", section 7.2.2. */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len < RSA_PKCS1_PADDING_SIZE) {
Define the error case's output in RSA_message_index_PKCS1_type_2. The use in s3_srvr.c doesn't care (it doesn't even have to be in bounds), but it's good to have the value be initialized and not a function of the input. (The old uninitialized case wasn't hit in s3_srvr.c because of the earlier bounds check.) Change-Id: Ib6b418b3c140aa564f8a46da3d34bb2b69f06195 Reviewed-on: https://boringssl-review.googlesource.com/2845 Reviewed-by: Adam Langley <agl@google.com>
2014-12-29 23:41:09 +00:00
/* |from| is zero-padded to the size of the RSA modulus, a public value, so
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
* this can be rejected in non-constant time. */
OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
return -1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
unsigned first_byte_is_zero = constant_time_eq(from[0], 0);
unsigned second_byte_is_two = constant_time_eq(from[1], 2);
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
unsigned i, zero_index = 0, looking_for_index = ~0u;
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
for (i = 2; i < from_len; i++) {
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
unsigned equals0 = constant_time_is_zero(from[i]);
zero_index = constant_time_select(looking_for_index & equals0, (unsigned)i,
zero_index);
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
looking_for_index = constant_time_select(equals0, 0, looking_for_index);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
/* The input must begin with 00 02. */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
unsigned valid_index = first_byte_is_zero;
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
valid_index &= second_byte_is_two;
/* We must have found the end of PS. */
valid_index &= ~looking_for_index;
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
/* PS must be at least 8 bytes long, and it starts two bytes into |from|. */
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
valid_index &= constant_time_ge(zero_index, 2 + 8);
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
/* Skip the zero byte. */
Define the error case's output in RSA_message_index_PKCS1_type_2. The use in s3_srvr.c doesn't care (it doesn't even have to be in bounds), but it's good to have the value be initialized and not a function of the input. (The old uninitialized case wasn't hit in s3_srvr.c because of the earlier bounds check.) Change-Id: Ib6b418b3c140aa564f8a46da3d34bb2b69f06195 Reviewed-on: https://boringssl-review.googlesource.com/2845 Reviewed-by: Adam Langley <agl@google.com>
2014-12-29 23:41:09 +00:00
zero_index++;
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
/* NOTE: Although this logic attempts to be constant time, the API contracts
* of this function and |RSA_decrypt| with |RSA_PKCS1_PADDING| make it
* impossible to completely avoid Bleichenbacher's attack. Consumers should
* use |RSA_unpad_key_pkcs1|. */
if (!valid_index) {
OPENSSL_PUT_ERROR(RSA, RSA_R_PKCS_DECODING_ERROR);
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
return -1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
const unsigned msg_len = from_len - zero_index;
if (msg_len > to_len) {
/* This shouldn't happen because this function is always called with
* |to_len| as the key size and |from_len| is bounded by the key size. */
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_PKCS_DECODING_ERROR);
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
return -1;
}
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (msg_len > INT_MAX) {
OPENSSL_PUT_ERROR(RSA, ERR_R_OVERFLOW);
Improve constant-time padding check in RSA key exchange. Although the PKCS#1 padding check is internally constant-time, it is not constant time at the crypto/ ssl/ API boundary. Expose a constant-time RSA_message_index_PKCS1_type_2 function and integrate it into the timing-sensitive portion of the RSA key exchange logic. Change-Id: I6fa64ddc9d65564d05529d9b2985da7650d058c3 Reviewed-on: https://boringssl-review.googlesource.com/1301 Reviewed-by: Adam Langley <agl@google.com>
2014-07-24 20:34:14 +01:00
return -1;
Fix padding side-channels. This patch tweaks the OAEP padding check to be slightly more constant time and rewrites the PKCS#1 v1.5 padding check to the same end.
2014-06-20 20:00:00 +01:00
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(to, &from[zero_index], msg_len);
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
return (int)msg_len;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_add_none(uint8_t *to, unsigned to_len, const uint8_t *from,
unsigned from_len) {
if (from_len > to_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len < to_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(to, from, from_len);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
static int PKCS1_MGF1(uint8_t *out, size_t len, const uint8_t *seed,
size_t seed_len, const EVP_MD *md) {
int ret = 0;
EVP_MD_CTX ctx;
EVP_MD_CTX_init(&ctx);
size_t md_len = EVP_MD_size(md);
for (uint32_t i = 0; len > 0; i++) {
uint8_t counter[4];
counter[0] = (uint8_t)(i >> 24);
counter[1] = (uint8_t)(i >> 16);
counter[2] = (uint8_t)(i >> 8);
counter[3] = (uint8_t)i;
if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
!EVP_DigestUpdate(&ctx, seed, seed_len) ||
!EVP_DigestUpdate(&ctx, counter, sizeof(counter))) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (md_len <= len) {
if (!EVP_DigestFinal_ex(&ctx, out, NULL)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
out += md_len;
len -= md_len;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
} else {
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
uint8_t digest[EVP_MAX_MD_SIZE];
if (!EVP_DigestFinal_ex(&ctx, digest, NULL)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(out, digest, len);
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
len = 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
ret = 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
err:
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
EVP_MD_CTX_cleanup(&ctx);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return ret;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_add_PKCS1_OAEP_mgf1(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len,
const uint8_t *param, unsigned param_len,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
const EVP_MD *md, const EVP_MD *mgf1md) {
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
unsigned i, emlen, mdlen;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
uint8_t *db, *seed;
Fix OAEP with non-SHA hash functions. Due to merging our patched 1.0.1 code with the 1.0.2 code, some parts of upstream's 25f93585a70fb05bb9f911884ab95e560f662a5d didn't make it into the code. https://code.google.com/p/chromium/issues/detail?id=397333 Change-Id: Iceb13e63a7ac91474fd39e7faad11fa52c56185d Reviewed-on: https://boringssl-review.googlesource.com/1310 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 01:16:16 +01:00
uint8_t *dbmask = NULL, seedmask[EVP_MAX_MD_SIZE];
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int ret = 0;
if (md == NULL) {
md = EVP_sha1();
}
if (mgf1md == NULL) {
mgf1md = md;
}
mdlen = EVP_MD_size(md);
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (to_len < 2 * mdlen + 2) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
return 0;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
emlen = to_len - 1;
if (from_len > emlen - 2 * mdlen - 1) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
if (emlen < 2 * mdlen + 1) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
to[0] = 0;
seed = to + 1;
db = to + mdlen + 1;
Remove unnecessary type casts in crypto/rsa. Change-Id: I0b5c661674fbcaf6b4d5b0ce7944459cd45606b1 Reviewed-on: https://boringssl-review.googlesource.com/7466 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-15 23:00:49 +00:00
if (!EVP_Digest(param, param_len, db, NULL, md, NULL)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(db + mdlen, 0, emlen - from_len - 2 * mdlen - 1);
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
db[emlen - from_len - mdlen - 1] = 0x01;
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(db + emlen - from_len - mdlen, from, from_len);
Consistently use RAND_bytes and check for failure. RAND_pseudo_bytes just calls RAND_bytes now and only returns 0 or 1. Switch all callers within the library call the new one and use the simpler failure check. This fixes a few error checks that no longer work (< 0) and some missing ones. Change-Id: Id51c79deec80075949f73fa1fbd7b76aac5570c6 Reviewed-on: https://boringssl-review.googlesource.com/2621 Reviewed-by: Adam Langley <agl@google.com>
2014-12-16 12:48:10 +00:00
if (!RAND_bytes(seed, mdlen)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
dbmask = OPENSSL_malloc(emlen - mdlen);
if (dbmask == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(dbmask, emlen - mdlen, seed, mdlen, mgf1md)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto out;
}
for (i = 0; i < emlen - mdlen; i++) {
db[i] ^= dbmask[i];
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(seedmask, mdlen, db, emlen - mdlen, mgf1md)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto out;
}
Fix OAEP with non-SHA hash functions. Due to merging our patched 1.0.1 code with the 1.0.2 code, some parts of upstream's 25f93585a70fb05bb9f911884ab95e560f662a5d didn't make it into the code. https://code.google.com/p/chromium/issues/detail?id=397333 Change-Id: Iceb13e63a7ac91474fd39e7faad11fa52c56185d Reviewed-on: https://boringssl-review.googlesource.com/1310 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 01:16:16 +01:00
for (i = 0; i < mdlen; i++) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
seed[i] ^= seedmask[i];
}
ret = 1;
out:
Remove unnecessary NULL checks, part 4. Finish up crypto, minus the legacy modules we haven't been touching much. Change-Id: I0e9e1999a627aed5fb14841f8a2a7d0b68398e85 Reviewed-on: https://boringssl-review.googlesource.com/4517 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 21:09:09 +01:00
OPENSSL_free(dbmask);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return ret;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
int RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *to, unsigned to_len,
const uint8_t *from, unsigned from_len,
const uint8_t *param, unsigned param_len,
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
const EVP_MD *md, const EVP_MD *mgf1md) {
Initialize |one_index| in OAEP padding check. This was a mistake in https://boringssl-review.googlesource.com/6611. Change-Id: Ifb5c52cc7571b6f1ada4af9b46eab1f9b080b4f6 Reviewed-on: https://boringssl-review.googlesource.com/6730 Reviewed-by: Adam Langley <agl@google.com>
2015-12-15 19:44:19 +00:00
unsigned i, dblen, mlen = -1, mdlen, bad, looking_for_one_byte, one_index = 0;
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
const uint8_t *maskeddb, *maskedseed;
Fix OAEP with non-SHA hash functions. Due to merging our patched 1.0.1 code with the 1.0.2 code, some parts of upstream's 25f93585a70fb05bb9f911884ab95e560f662a5d didn't make it into the code. https://code.google.com/p/chromium/issues/detail?id=397333 Change-Id: Iceb13e63a7ac91474fd39e7faad11fa52c56185d Reviewed-on: https://boringssl-review.googlesource.com/1310 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 01:16:16 +01:00
uint8_t *db = NULL, seed[EVP_MAX_MD_SIZE], phash[EVP_MAX_MD_SIZE];
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (md == NULL) {
md = EVP_sha1();
}
if (mgf1md == NULL) {
mgf1md = md;
}
mdlen = EVP_MD_size(md);
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
/* The encoded message is one byte smaller than the modulus to ensure that it
* doesn't end up greater than the modulus. Thus there's an extra "+1" here
* compared to https://tools.ietf.org/html/rfc2437#section-9.1.1.2. */
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (from_len < 1 + 2*mdlen + 1) {
/* 'from_len' is the length of the modulus, i.e. does not depend on the
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
* particular ciphertext. */
goto decoding_err;
}
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
dblen = from_len - mdlen - 1;
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
db = OPENSSL_malloc(dblen);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (db == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
Fix error-handling bugs. Caught by clang scan-build. Change-Id: I133d0338fe38172d687c02099d909366a59ee95b Reviewed-on: https://boringssl-review.googlesource.com/1343 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 08:58:53 +01:00
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
maskedseed = from + 1;
maskeddb = from + 1 + mdlen;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(seed, mdlen, maskeddb, dblen, mgf1md)) {
Fix error-handling bugs. Caught by clang scan-build. Change-Id: I133d0338fe38172d687c02099d909366a59ee95b Reviewed-on: https://boringssl-review.googlesource.com/1343 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 08:58:53 +01:00
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
for (i = 0; i < mdlen; i++) {
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
seed[i] ^= maskedseed[i];
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(db, dblen, seed, mdlen, mgf1md)) {
Fix error-handling bugs. Caught by clang scan-build. Change-Id: I133d0338fe38172d687c02099d909366a59ee95b Reviewed-on: https://boringssl-review.googlesource.com/1343 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 08:58:53 +01:00
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
for (i = 0; i < dblen; i++) {
db[i] ^= maskeddb[i];
}
Remove unnecessary type casts in crypto/rsa. Change-Id: I0b5c661674fbcaf6b4d5b0ce7944459cd45606b1 Reviewed-on: https://boringssl-review.googlesource.com/7466 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-15 23:00:49 +00:00
if (!EVP_Digest(param, param_len, phash, NULL, md, NULL)) {
Fix error-handling bugs. Caught by clang scan-build. Change-Id: I133d0338fe38172d687c02099d909366a59ee95b Reviewed-on: https://boringssl-review.googlesource.com/1343 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 08:58:53 +01:00
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
bad = ~constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));
bad |= ~constant_time_is_zero(from[0]);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
looking_for_one_byte = ~0u;
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
for (i = mdlen; i < dblen; i++) {
Convert rsa/padding.c to constant-time helpers. Remove the custom copy of those helpers. Change-Id: I810c3ae8dbf7bc0654d3e9fb9900c425d36f64aa Reviewed-on: https://boringssl-review.googlesource.com/6611 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 01:32:22 +00:00
unsigned equals1 = constant_time_eq(db[i], 1);
unsigned equals0 = constant_time_eq(db[i], 0);
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
one_index = constant_time_select(looking_for_one_byte & equals1, i,
one_index);
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
looking_for_one_byte =
constant_time_select(equals1, 0, looking_for_one_byte);
bad |= looking_for_one_byte & ~equals0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
bad |= looking_for_one_byte;
if (bad) {
goto decoding_err;
}
one_index++;
mlen = dblen - one_index;
Simplify RSA key exchange padding check. This check was fixed a while ago, but it could have been much simpler. In the RSA key exchange, the expected size of the output is known, making the padding check much simpler. There isn't any use in exporting the more general RSA_message_index_PKCS1_type_2. (Without knowing the expected size, any integrity check or swap to randomness or other mitigation is basically doomed to fail.) Verified with the valgrind uninitialized memory trick that we're still constant-time. Also update rsa.h to recommend against using the PKCS#1 v1.5 schemes. Thanks to Ryan Sleevi for the suggestion. Change-Id: I4328076b1d2e5e06617dd8907cdaa702635c2651 Reviewed-on: https://boringssl-review.googlesource.com/6613 Reviewed-by: Adam Langley <agl@google.com>
2015-12-02 00:31:24 +00:00
if (to_len < mlen) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE);
Improvements in constant-time OAEP decoding. This change adds a new function, BN_bn2bin_padded, that attempts, as much as possible, to serialise a BIGNUM in constant time. This is used to avoid some timing leaks in RSA decryption.
2014-06-20 20:00:00 +01:00
mlen = -1;
} else {
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(to, db + one_index, mlen);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
OPENSSL_free(db);
return mlen;
decoding_err:
/* to avoid chosen ciphertext attacks, the error message should not reveal
* which kind of decoding error happened */
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_OAEP_DECODING_ERROR);
Fix error-handling bugs. Caught by clang scan-build. Change-Id: I133d0338fe38172d687c02099d909366a59ee95b Reviewed-on: https://boringssl-review.googlesource.com/1343 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 08:58:53 +01:00
err:
Remove unnecessary NULL checks, part 4. Finish up crypto, minus the legacy modules we haven't been touching much. Change-Id: I0e9e1999a627aed5fb14841f8a2a7d0b68398e85 Reviewed-on: https://boringssl-review.googlesource.com/4517 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 21:09:09 +01:00
OPENSSL_free(db);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
static const unsigned char zeroes[] = {0,0,0,0,0,0,0,0};
int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const uint8_t *mHash,
const EVP_MD *Hash, const EVP_MD *mgf1Hash,
const uint8_t *EM, int sLen) {
int i;
int ret = 0;
int maskedDBLen, MSBits, emLen;
size_t hLen;
const uint8_t *H;
uint8_t *DB = NULL;
EVP_MD_CTX ctx;
uint8_t H_[EVP_MAX_MD_SIZE];
EVP_MD_CTX_init(&ctx);
if (mgf1Hash == NULL) {
mgf1Hash = Hash;
}
hLen = EVP_MD_size(Hash);
/* Negative sLen has special meanings:
* -1 sLen == hLen
* -2 salt length is autorecovered from signature
* -N reserved */
if (sLen == -1) {
sLen = hLen;
} else if (sLen == -2) {
sLen = -2;
} else if (sLen < -2) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
emLen = RSA_size(rsa);
if (EM[0] & (0xFF << MSBits)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_FIRST_OCTET_INVALID);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
if (MSBits == 0) {
EM++;
emLen--;
}
Fix bounds check in RSA_verify_PKCS1_PSS_mgf1 when sLen is -2. (Imported from upstream's 04cf39207f94abf89b3964c7710f22f829a1a78f.) The other half of the change was fixed earlier, but this logic was still off. This code is kind of a mess and needs a rewrite, but import the change to get it correct and sufficiently tested first. (If we could take the sLen = -2 case away altogether, that would be great...) Change-Id: I5786e980f26648822633fc216315e8f77ed4d45b Reviewed-on: https://boringssl-review.googlesource.com/14321 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-20 23:21:36 +00:00
if (emLen < (int)hLen + 2 || emLen < ((int)hLen + sLen + 2)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* sLen can be small negative */
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
if (EM[emLen - 1] != 0xbc) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_LAST_OCTET_INVALID);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
maskedDBLen = emLen - hLen - 1;
H = EM + maskedDBLen;
DB = OPENSSL_malloc(maskedDBLen);
if (!DB) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
for (i = 0; i < maskedDBLen; i++) {
DB[i] ^= EM[i];
}
if (MSBits) {
DB[0] &= 0xFF >> (8 - MSBits);
}
Add in missing curly braces part 3. Everything else. Change-Id: Iac02b144465b4e7b6d69ea22ff2aaf52695ae732
2015-02-11 06:17:41 +00:00
for (i = 0; DB[i] == 0 && i < (maskedDBLen - 1); i++) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
;
Add in missing curly braces part 3. Everything else. Change-Id: Iac02b144465b4e7b6d69ea22ff2aaf52695ae732
2015-02-11 06:17:41 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (DB[i++] != 0x1) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_RECOVERY_FAILED);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
if (sLen >= 0 && (maskedDBLen - i) != sLen) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
if (!EVP_DigestInit_ex(&ctx, Hash, NULL) ||
!EVP_DigestUpdate(&ctx, zeroes, sizeof zeroes) ||
!EVP_DigestUpdate(&ctx, mHash, hLen)) {
goto err;
}
if (maskedDBLen - i) {
if (!EVP_DigestUpdate(&ctx, DB + i, maskedDBLen - i)) {
goto err;
}
}
if (!EVP_DigestFinal_ex(&ctx, H_, NULL)) {
goto err;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
if (OPENSSL_memcmp(H_, H, hLen)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_SIGNATURE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
ret = 0;
} else {
ret = 1;
}
err:
Remove unnecessary NULL checks, part 4. Finish up crypto, minus the legacy modules we haven't been touching much. Change-Id: I0e9e1999a627aed5fb14841f8a2a7d0b68398e85 Reviewed-on: https://boringssl-review.googlesource.com/4517 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 21:09:09 +01:00
OPENSSL_free(DB);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
EVP_MD_CTX_cleanup(&ctx);
return ret;
}
int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM,
const unsigned char *mHash,
const EVP_MD *Hash, const EVP_MD *mgf1Hash,
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
int sLenRequested) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int ret = 0;
Don't compare signed vs. unsigned. This resolves a pile of MSVC warnings in Chromium. Change-Id: Ib9a29cb88d8ed8ec4118d153260f775be059a803 Reviewed-on: https://boringssl-review.googlesource.com/1865 Reviewed-by: Adam Langley <agl@google.com>
2014-10-01 02:00:38 +01:00
size_t maskedDBLen, MSBits, emLen;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
size_t hLen;
unsigned char *H, *salt = NULL, *p;
EVP_MD_CTX ctx;
if (mgf1Hash == NULL) {
mgf1Hash = Hash;
}
hLen = EVP_MD_size(Hash);
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
if (BN_is_zero(rsa->n)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_EMPTY_PUBLIC_KEY);
Fix limit checks in RSA padding functions. More signed/unsigned issues, and some other missing checks. Change-Id: Ib64429a609ca2d64b74a4744092aac67ad0af4e5 Reviewed-on: https://boringssl-review.googlesource.com/1252 Reviewed-by: Adam Langley <agl@google.com>
2014-07-18 00:19:07 +01:00
goto err;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
MSBits = (BN_num_bits(rsa->n) - 1) & 0x7;
emLen = RSA_size(rsa);
if (MSBits == 0) {
Don't compare signed vs. unsigned. This resolves a pile of MSVC warnings in Chromium. Change-Id: Ib9a29cb88d8ed8ec4118d153260f775be059a803 Reviewed-on: https://boringssl-review.googlesource.com/1865 Reviewed-by: Adam Langley <agl@google.com>
2014-10-01 02:00:38 +01:00
assert(emLen >= 1);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
*EM++ = 0;
emLen--;
}
Put |sLen| logic in one place in RSA_padding_add_PKCS1_PSS_mgf1. This makes it easier to understand the |sLen|-related logic. Change-Id: I98da4f4f7c82d5481544940407e6cc6a963f7e5b Reviewed-on: https://boringssl-review.googlesource.com/9171 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-08 23:18:10 +01:00
Clarify checking of emLen in RSA_padding_add_PKCS1_PSS_mgf1. There is a comment "Note from a test above this value is guaranteed to be non-negative". Reorganize the code to make it more clear that that is actually the case, especially in the case where sLen == -1. Change-Id: I09a3dd99458e34102c42d8d3a2f22c16c684c673 Reviewed-on: https://boringssl-review.googlesource.com/9172 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:20:36 +01:00
if (emLen < hLen + 2) {
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
goto err;
}
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
/* Negative sLenRequested has special meanings:
Put |sLen| logic in one place in RSA_padding_add_PKCS1_PSS_mgf1. This makes it easier to understand the |sLen|-related logic. Change-Id: I98da4f4f7c82d5481544940407e6cc6a963f7e5b Reviewed-on: https://boringssl-review.googlesource.com/9171 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-08 23:18:10 +01:00
* -1 sLen == hLen
* -2 salt length is maximized
* -N reserved */
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
size_t sLen;
if (sLenRequested == -1) {
Put |sLen| logic in one place in RSA_padding_add_PKCS1_PSS_mgf1. This makes it easier to understand the |sLen|-related logic. Change-Id: I98da4f4f7c82d5481544940407e6cc6a963f7e5b Reviewed-on: https://boringssl-review.googlesource.com/9171 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-08 23:18:10 +01:00
sLen = hLen;
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
} else if (sLenRequested == -2) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
sLen = emLen - hLen - 2;
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
} else if (sLenRequested < 0) {
Put |sLen| logic in one place in RSA_padding_add_PKCS1_PSS_mgf1. This makes it easier to understand the |sLen|-related logic. Change-Id: I98da4f4f7c82d5481544940407e6cc6a963f7e5b Reviewed-on: https://boringssl-review.googlesource.com/9171 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-08 23:18:10 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED);
goto err;
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
} else {
sLen = (size_t)sLenRequested;
Clarify checking of emLen in RSA_padding_add_PKCS1_PSS_mgf1. There is a comment "Note from a test above this value is guaranteed to be non-negative". Reorganize the code to make it more clear that that is actually the case, especially in the case where sLen == -1. Change-Id: I09a3dd99458e34102c42d8d3a2f22c16c684c673 Reviewed-on: https://boringssl-review.googlesource.com/9172 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:20:36 +01:00
}
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
if (emLen - hLen - 2 < sLen) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Clarify checking of emLen in RSA_padding_add_PKCS1_PSS_mgf1. There is a comment "Note from a test above this value is guaranteed to be non-negative". Reorganize the code to make it more clear that that is actually the case, especially in the case where sLen == -1. Change-Id: I09a3dd99458e34102c42d8d3a2f22c16c684c673 Reviewed-on: https://boringssl-review.googlesource.com/9172 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:20:36 +01:00
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (sLen > 0) {
salt = OPENSSL_malloc(sLen);
if (!salt) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Consistently use RAND_bytes and check for failure. RAND_pseudo_bytes just calls RAND_bytes now and only returns 0 or 1. Switch all callers within the library call the new one and use the simpler failure check. This fixes a few error checks that no longer work (< 0) and some missing ones. Change-Id: Id51c79deec80075949f73fa1fbd7b76aac5570c6 Reviewed-on: https://boringssl-review.googlesource.com/2621 Reviewed-by: Adam Langley <agl@google.com>
2014-12-16 12:48:10 +00:00
if (!RAND_bytes(salt, sLen)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
}
maskedDBLen = emLen - hLen - 1;
H = EM + maskedDBLen;
EVP_MD_CTX_init(&ctx);
if (!EVP_DigestInit_ex(&ctx, Hash, NULL) ||
!EVP_DigestUpdate(&ctx, zeroes, sizeof zeroes) ||
!EVP_DigestUpdate(&ctx, mHash, hLen)) {
goto err;
}
if (sLen && !EVP_DigestUpdate(&ctx, salt, sLen)) {
goto err;
}
if (!EVP_DigestFinal_ex(&ctx, H, NULL)) {
goto err;
}
EVP_MD_CTX_cleanup(&ctx);
/* Generate dbMask in place then perform XOR on it */
Tidy up PKCS1_MGF1. Fix non-standard variable names, return value convention, unsigned vs size_t, etc. This also fixes one size_t truncation warning. BUG=22 Change-Id: Ibe083db90e8dac45d64da9ead8f519dd2fea96ea Reviewed-on: https://boringssl-review.googlesource.com/9133 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-04 22:48:42 +01:00
if (!PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
p = EM;
/* Initial PS XORs with all zeroes which is a NOP so just update
* pointer. Note from a test above this value is guaranteed to
* be non-negative. */
p += emLen - sLen - hLen - 2;
*p++ ^= 0x1;
if (sLen > 0) {
Clarify signed/unsigned math in RSA_padding_add_PKCS1_PSS_mgf1. Use a separate |size_t| variable for all logic that happens after the special casing of the negative values of the signed parameter, to minimize the amount of mixed signed/unsigned math used. Change-Id: I4aeb1ffce47f889f340f9583684910b0fb2ca7c7 Reviewed-on: https://boringssl-review.googlesource.com/9173 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-08 23:29:23 +01:00
for (size_t i = 0; i < sLen; i++) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
*p++ ^= salt[i];
}
}
if (MSBits) {
EM[0] &= 0xFF >> (8 - MSBits);
}
/* H is already in place so just set final 0xbc */
EM[emLen - 1] = 0xbc;
ret = 1;
err:
Remove unnecessary NULL checks, part 4. Finish up crypto, minus the legacy modules we haven't been touching much. Change-Id: I0e9e1999a627aed5fb14841f8a2a7d0b68398e85 Reviewed-on: https://boringssl-review.googlesource.com/4517 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 21:09:09 +01:00
OPENSSL_free(salt);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return ret;
}
Reference in New Issue Copy Permalink