Source file
src/crypto/rsa/pkcs1v15.go
1
2
3
4
5 package rsa
6
7 import (
8 "crypto"
9 "crypto/subtle"
10 "errors"
11 "io"
12 "math/big"
13 )
14
15
16
17
18
19 type PKCS1v15DecryptOptions struct {
20
21
22
23
24 SessionKeyLen int
25 }
26
27
28
29
30
31
32
33
34
35
36
37 func EncryptPKCS1v15(rand io.Reader, pub *PublicKey, msg []byte) ([]byte, error) {
38 if err := checkPub(pub); err != nil {
39 return nil, err
40 }
41 k := (pub.N.BitLen() + 7) / 8
42 if len(msg) > k-11 {
43 return nil, ErrMessageTooLong
44 }
45
46
47 em := make([]byte, k)
48 em[1] = 2
49 ps, mm := em[2:len(em)-len(msg)-1], em[len(em)-len(msg):]
50 err := nonZeroRandomBytes(ps, rand)
51 if err != nil {
52 return nil, err
53 }
54 em[len(em)-len(msg)-1] = 0
55 copy(mm, msg)
56
57 m := new(big.Int).SetBytes(em)
58 c := encrypt(new(big.Int), pub, m)
59
60 copyWithLeftPad(em, c.Bytes())
61 return em, nil
62 }
63
64
65
66
67
68
69
70
71
72 func DecryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) ([]byte, error) {
73 if err := checkPub(&priv.PublicKey); err != nil {
74 return nil, err
75 }
76 valid, out, index, err := decryptPKCS1v15(rand, priv, ciphertext)
77 if err != nil {
78 return nil, err
79 }
80 if valid == 0 {
81 return nil, ErrDecryption
82 }
83 return out[index:], nil
84 }
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105 func DecryptPKCS1v15SessionKey(rand io.Reader, priv *PrivateKey, ciphertext []byte, key []byte) error {
106 if err := checkPub(&priv.PublicKey); err != nil {
107 return err
108 }
109 k := (priv.N.BitLen() + 7) / 8
110 if k-(len(key)+3+8) < 0 {
111 return ErrDecryption
112 }
113
114 valid, em, index, err := decryptPKCS1v15(rand, priv, ciphertext)
115 if err != nil {
116 return err
117 }
118
119 if len(em) != k {
120
121
122 return ErrDecryption
123 }
124
125 valid &= subtle.ConstantTimeEq(int32(len(em)-index), int32(len(key)))
126 subtle.ConstantTimeCopy(valid, key, em[len(em)-len(key):])
127 return nil
128 }
129
130
131
132
133
134
135
136 func decryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) (valid int, em []byte, index int, err error) {
137 k := (priv.N.BitLen() + 7) / 8
138 if k < 11 {
139 err = ErrDecryption
140 return
141 }
142
143 c := new(big.Int).SetBytes(ciphertext)
144 m, err := decrypt(rand, priv, c)
145 if err != nil {
146 return
147 }
148
149 em = leftPad(m.Bytes(), k)
150 firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0)
151 secondByteIsTwo := subtle.ConstantTimeByteEq(em[1], 2)
152
153
154
155
156
157 lookingForIndex := 1
158
159 for i := 2; i < len(em); i++ {
160 equals0 := subtle.ConstantTimeByteEq(em[i], 0)
161 index = subtle.ConstantTimeSelect(lookingForIndex&equals0, i, index)
162 lookingForIndex = subtle.ConstantTimeSelect(equals0, 0, lookingForIndex)
163 }
164
165
166
167 validPS := subtle.ConstantTimeLessOrEq(2+8, index)
168
169 valid = firstByteIsZero & secondByteIsTwo & (^lookingForIndex & 1) & validPS
170 index = subtle.ConstantTimeSelect(valid, index+1, 0)
171 return valid, em, index, nil
172 }
173
174
175 func nonZeroRandomBytes(s []byte, rand io.Reader) (err error) {
176 _, err = io.ReadFull(rand, s)
177 if err != nil {
178 return
179 }
180
181 for i := 0; i < len(s); i++ {
182 for s[i] == 0 {
183 _, err = io.ReadFull(rand, s[i:i+1])
184 if err != nil {
185 return
186 }
187
188
189 s[i] ^= 0x42
190 }
191 }
192
193 return
194 }
195
196
197
198
199
200
201
202
203
204 var hashPrefixes = map[crypto.Hash][]byte{
205 crypto.MD5: {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
206 crypto.SHA1: {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14},
207 crypto.SHA224: {0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1c},
208 crypto.SHA256: {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20},
209 crypto.SHA384: {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30},
210 crypto.SHA512: {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40},
211 crypto.MD5SHA1: {},
212 crypto.RIPEMD160: {0x30, 0x20, 0x30, 0x08, 0x06, 0x06, 0x28, 0xcf, 0x06, 0x03, 0x00, 0x31, 0x04, 0x14},
213 }
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228 func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
229 hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
230 if err != nil {
231 return nil, err
232 }
233
234 tLen := len(prefix) + hashLen
235 k := (priv.N.BitLen() + 7) / 8
236 if k < tLen+11 {
237 return nil, ErrMessageTooLong
238 }
239
240
241 em := make([]byte, k)
242 em[1] = 1
243 for i := 2; i < k-tLen-1; i++ {
244 em[i] = 0xff
245 }
246 copy(em[k-tLen:k-hashLen], prefix)
247 copy(em[k-hashLen:k], hashed)
248
249 m := new(big.Int).SetBytes(em)
250 c, err := decryptAndCheck(rand, priv, m)
251 if err != nil {
252 return nil, err
253 }
254
255 copyWithLeftPad(em, c.Bytes())
256 return em, nil
257 }
258
259
260
261
262
263
264 func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte) error {
265 hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
266 if err != nil {
267 return err
268 }
269
270 tLen := len(prefix) + hashLen
271 k := (pub.N.BitLen() + 7) / 8
272 if k < tLen+11 {
273 return ErrVerification
274 }
275
276 c := new(big.Int).SetBytes(sig)
277 m := encrypt(new(big.Int), pub, c)
278 em := leftPad(m.Bytes(), k)
279
280
281 ok := subtle.ConstantTimeByteEq(em[0], 0)
282 ok &= subtle.ConstantTimeByteEq(em[1], 1)
283 ok &= subtle.ConstantTimeCompare(em[k-hashLen:k], hashed)
284 ok &= subtle.ConstantTimeCompare(em[k-tLen:k-hashLen], prefix)
285 ok &= subtle.ConstantTimeByteEq(em[k-tLen-1], 0)
286
287 for i := 2; i < k-tLen-1; i++ {
288 ok &= subtle.ConstantTimeByteEq(em[i], 0xff)
289 }
290
291 if ok != 1 {
292 return ErrVerification
293 }
294
295 return nil
296 }
297
298 func pkcs1v15HashInfo(hash crypto.Hash, inLen int) (hashLen int, prefix []byte, err error) {
299
300
301 if hash == 0 {
302 return inLen, nil, nil
303 }
304
305 hashLen = hash.Size()
306 if inLen != hashLen {
307 return 0, nil, errors.New("crypto/rsa: input must be hashed message")
308 }
309 prefix, ok := hashPrefixes[hash]
310 if !ok {
311 return 0, nil, errors.New("crypto/rsa: unsupported hash function")
312 }
313 return
314 }
315
316
317
318 func copyWithLeftPad(dest, src []byte) {
319 numPaddingBytes := len(dest) - len(src)
320 for i := 0; i < numPaddingBytes; i++ {
321 dest[i] = 0
322 }
323 copy(dest[numPaddingBytes:], src)
324 }
325
View as plain text