rsa.c

Go to the documentation of this file.

/* RSA asymmetric public-key algorithm [RFC3447]
 *
 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells ([email protected])
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public Licence
 * as published by the Free Software Foundation; either version
 * 2 of the Licence, or (at your option) any later version.
 */

#define pr_fmt(fmt) "RSA: "fmt
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include "public_key.h"

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("RSA Public Key Algorithm");

#define kenter(FMT, ...) \
    pr_devel("==> %s("FMT")\n", __func__, ##__VA_ARGS__)
#define kleave(FMT, ...) \
    pr_devel("<== %s()"FMT"\n", __func__, ##__VA_ARGS__)

/*
 * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
 */
static const u8 RSA_digest_info_MD5[] = {
    0x30, 0x20, 0x30, 0x0C, 0x06, 0x08,
    0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, /* OID */
    0x05, 0x00, 0x04, 0x10
};

static const u8 RSA_digest_info_SHA1[] = {
    0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
    0x2B, 0x0E, 0x03, 0x02, 0x1A,
    0x05, 0x00, 0x04, 0x14
};

static const u8 RSA_digest_info_RIPE_MD_160[] = {
    0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
    0x2B, 0x24, 0x03, 0x02, 0x01,
    0x05, 0x00, 0x04, 0x14
};

static const u8 RSA_digest_info_SHA224[] = {
    0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
    0x05, 0x00, 0x04, 0x1C
};

static const u8 RSA_digest_info_SHA256[] = {
    0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
    0x05, 0x00, 0x04, 0x20
};

static const u8 RSA_digest_info_SHA384[] = {
    0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
    0x05, 0x00, 0x04, 0x30
};

static const u8 RSA_digest_info_SHA512[] = {
    0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
    0x05, 0x00, 0x04, 0x40
};

static const struct {
    const u8 *data;
    size_t size;
} RSA_ASN1_templates[PKEY_HASH__LAST] = {
#define _(X) { RSA_digest_info_##X, sizeof(RSA_digest_info_##X) }
    [PKEY_HASH_MD5]     = _(MD5),
    [PKEY_HASH_SHA1]    = _(SHA1),
    [PKEY_HASH_RIPE_MD_160] = _(RIPE_MD_160),
    [PKEY_HASH_SHA256]  = _(SHA256),
    [PKEY_HASH_SHA384]  = _(SHA384),
    [PKEY_HASH_SHA512]  = _(SHA512),
    [PKEY_HASH_SHA224]  = _(SHA224),
#undef _
};

/*
 * RSAVP1() function [RFC3447 sec 5.2.2]
 */
static int RSAVP1(const struct public_key *key, MPI s, MPI *_m)
{
    MPI m;
    int ret;

    /* (1) Validate 0 <= s < n */
    if (mpi_cmp_ui(s, 0) < 0) {
        kleave(" = -EBADMSG [s < 0]");
        return -EBADMSG;
    }
    if (mpi_cmp(s, key->rsa.n) >= 0) {
        kleave(" = -EBADMSG [s >= n]");
        return -EBADMSG;
    }

    m = mpi_alloc(0);
    if (!m)
        return -ENOMEM;

    /* (2) m = s^e mod n */
    ret = mpi_powm(m, s, key->rsa.e, key->rsa.n);
    if (ret < 0) {
        mpi_free(m);
        return ret;
    }

    *_m = m;
    return 0;
}

/*
 * Integer to Octet String conversion [RFC3447 sec 4.1]
 */
static int RSA_I2OSP(MPI x, size_t xLen, u8 **_X)
{
    unsigned X_size, x_size;
    int X_sign;
    u8 *X;

    /* Make sure the string is the right length.  The number should begin
     * with { 0x00, 0x01, ... } so we have to account for 15 leading zero
     * bits not being reported by MPI.
     */
    x_size = mpi_get_nbits(x);
    pr_devel("size(x)=%u xLen*8=%zu\n", x_size, xLen * 8);
    if (x_size != xLen * 8 - 15)
        return -ERANGE;

    X = mpi_get_buffer(x, &X_size, &X_sign);
    if (!X)
        return -ENOMEM;
    if (X_sign < 0) {
        kfree(X);
        return -EBADMSG;
    }
    if (X_size != xLen - 1) {
        kfree(X);
        return -EBADMSG;
    }

    *_X = X;
    return 0;
}

/*
 * Perform the RSA signature verification.
 * @H: Value of hash of data and metadata
 * @EM: The computed signature value
 * @k: The size of EM (EM[0] is an invalid location but should hold 0x00)
 * @hash_size: The size of H
 * @asn1_template: The DigestInfo ASN.1 template
 * @asn1_size: Size of asm1_template[]
 */
static int RSA_verify(const u8 *H, const u8 *EM, size_t k, size_t hash_size,
              const u8 *asn1_template, size_t asn1_size)
{
    unsigned PS_end, T_offset, i;

    kenter(",,%zu,%zu,%zu", k, hash_size, asn1_size);

    if (k < 2 + 1 + asn1_size + hash_size)
        return -EBADMSG;

    /* Decode the EMSA-PKCS1-v1_5 */
    if (EM[1] != 0x01) {
        kleave(" = -EBADMSG [EM[1] == %02u]", EM[1]);
        return -EBADMSG;
    }

    T_offset = k - (asn1_size + hash_size);
    PS_end = T_offset - 1;
    if (EM[PS_end] != 0x00) {
        kleave(" = -EBADMSG [EM[T-1] == %02u]", EM[PS_end]);
        return -EBADMSG;
    }

    for (i = 2; i < PS_end; i++) {
        if (EM[i] != 0xff) {
            kleave(" = -EBADMSG [EM[PS%x] == %02u]", i - 2, EM[i]);
            return -EBADMSG;
        }
    }

    if (memcmp(asn1_template, EM + T_offset, asn1_size) != 0) {
        kleave(" = -EBADMSG [EM[T] ASN.1 mismatch]");
        return -EBADMSG;
    }

    if (memcmp(H, EM + T_offset + asn1_size, hash_size) != 0) {
        kleave(" = -EKEYREJECTED [EM[T] hash mismatch]");
        return -EKEYREJECTED;
    }

    kleave(" = 0");
    return 0;
}

/*
 * Perform the verification step [RFC3447 sec 8.2.2].
 */
static int RSA_verify_signature(const struct public_key *key,
                const struct public_key_signature *sig)
{
    size_t tsize;
    int ret;

    /* Variables as per RFC3447 sec 8.2.2 */
    const u8 *H = sig->digest;
    u8 *EM = NULL;
    MPI m = NULL;
    size_t k;

    kenter("");

    if (!RSA_ASN1_templates[sig->pkey_hash_algo].data)
        return -ENOTSUPP;

    /* (1) Check the signature size against the public key modulus size */
    k = mpi_get_nbits(key->rsa.n);
    tsize = mpi_get_nbits(sig->rsa.s);

    /* According to RFC 4880 sec 3.2, length of MPI is computed starting
     * from most significant bit.  So the RFC 3447 sec 8.2.2 size check
     * must be relaxed to conform with shorter signatures - so we fail here
     * only if signature length is longer than modulus size.
     */
    pr_devel("step 1: k=%zu size(S)=%zu\n", k, tsize);
    if (k < tsize) {
        ret = -EBADMSG;
        goto error;
    }

    /* Round up and convert to octets */
    k = (k + 7) / 8;

    /* (2b) Apply the RSAVP1 verification primitive to the public key */
    ret = RSAVP1(key, sig->rsa.s, &m);
    if (ret < 0)
        goto error;

    /* (2c) Convert the message representative (m) to an encoded message
     *      (EM) of length k octets.
     *
     *      NOTE!  The leading zero byte is suppressed by MPI, so we pass a
     *      pointer to the _preceding_ byte to RSA_verify()!
     */
    ret = RSA_I2OSP(m, k, &EM);
    if (ret < 0)
        goto error;

    ret = RSA_verify(H, EM - 1, k, sig->digest_size,
             RSA_ASN1_templates[sig->pkey_hash_algo].data,
             RSA_ASN1_templates[sig->pkey_hash_algo].size);

error:
    kfree(EM);
    mpi_free(m);
    kleave(" = %d", ret);
    return ret;
}

const struct public_key_algorithm RSA_public_key_algorithm = {
    .name       = "RSA",
    .n_pub_mpi  = 2,
    .n_sec_mpi  = 3,
    .n_sig_mpi  = 1,
    .verify_signature = RSA_verify_signature,
};
EXPORT_SYMBOL_GPL(RSA_public_key_algorithm);