GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: lib/libcrypto/rsa/rsa_sign.c Lines: 63 103 61.2 %
Date: 2017-11-13 Branches: 33 67 49.3 %

Line Branch Exec Source
1
/* $OpenBSD: rsa_sign.c,v 1.29 2017/05/02 03:59:45 deraadt Exp $ */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3
 * All rights reserved.
4
 *
5
 * This package is an SSL implementation written
6
 * by Eric Young (eay@cryptsoft.com).
7
 * The implementation was written so as to conform with Netscapes SSL.
8
 *
9
 * This library is free for commercial and non-commercial use as long as
10
 * the following conditions are aheared to.  The following conditions
11
 * apply to all code found in this distribution, be it the RC4, RSA,
12
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13
 * included with this distribution is covered by the same copyright terms
14
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15
 *
16
 * Copyright remains Eric Young's, and as such any Copyright notices in
17
 * the code are not to be removed.
18
 * If this package is used in a product, Eric Young should be given attribution
19
 * as the author of the parts of the library used.
20
 * This can be in the form of a textual message at program startup or
21
 * in documentation (online or textual) provided with the package.
22
 *
23
 * Redistribution and use in source and binary forms, with or without
24
 * modification, are permitted provided that the following conditions
25
 * are met:
26
 * 1. Redistributions of source code must retain the copyright
27
 *    notice, this list of conditions and the following disclaimer.
28
 * 2. Redistributions in binary form must reproduce the above copyright
29
 *    notice, this list of conditions and the following disclaimer in the
30
 *    documentation and/or other materials provided with the distribution.
31
 * 3. All advertising materials mentioning features or use of this software
32
 *    must display the following acknowledgement:
33
 *    "This product includes cryptographic software written by
34
 *     Eric Young (eay@cryptsoft.com)"
35
 *    The word 'cryptographic' can be left out if the rouines from the library
36
 *    being used are not cryptographic related :-).
37
 * 4. If you include any Windows specific code (or a derivative thereof) from
38
 *    the apps directory (application code) you must include an acknowledgement:
39
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40
 *
41
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51
 * SUCH DAMAGE.
52
 *
53
 * The licence and distribution terms for any publically available version or
54
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
55
 * copied and put under another distribution licence
56
 * [including the GNU Public Licence.]
57
 */
58
59
#include <stdio.h>
60
#include <string.h>
61
62
#include <openssl/bn.h>
63
#include <openssl/err.h>
64
#include <openssl/objects.h>
65
#include <openssl/rsa.h>
66
#include <openssl/x509.h>
67
68
#include "rsa_locl.h"
69
70
/* Size of an SSL signature: MD5+SHA1 */
71
#define SSL_SIG_LENGTH	36
72
73
int
74
RSA_sign(int type, const unsigned char *m, unsigned int m_len,
75
    unsigned char *sigret, unsigned int *siglen, RSA *rsa)
76
{
77
40592
	X509_SIG sig;
78
20296
	ASN1_TYPE parameter;
79
	int i, j, ret = 1;
80
20296
	unsigned char *p, *tmps = NULL;
81
	const unsigned char *s = NULL;
82
20296
	X509_ALGOR algor;
83
20296
	ASN1_OCTET_STRING digest;
84
85

20296
	if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign)
86
		return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
87
88
	/* Special case: SSL signature, just check the length */
89
20296
	if (type == NID_md5_sha1) {
90
20151
		if (m_len != SSL_SIG_LENGTH) {
91
			RSAerror(RSA_R_INVALID_MESSAGE_LENGTH);
92
			return 0;
93
		}
94
		i = SSL_SIG_LENGTH;
95
		s = m;
96
20151
	} else {
97
145
		sig.algor = &algor;
98
145
		sig.algor->algorithm = OBJ_nid2obj(type);
99
145
		if (sig.algor->algorithm == NULL) {
100
			RSAerror(RSA_R_UNKNOWN_ALGORITHM_TYPE);
101
			return 0;
102
		}
103
145
		if (sig.algor->algorithm->length == 0) {
104
			RSAerror(RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
105
			return 0;
106
		}
107
145
		parameter.type = V_ASN1_NULL;
108
145
		parameter.value.ptr = NULL;
109
145
		sig.algor->parameter = &parameter;
110
111
145
		sig.digest = &digest;
112
145
		sig.digest->data = (unsigned char *)m; /* TMP UGLY CAST */
113
145
		sig.digest->length = m_len;
114
115
145
		i = i2d_X509_SIG(&sig, NULL);
116
	}
117
20296
	j = RSA_size(rsa);
118
20296
	if (i > j - RSA_PKCS1_PADDING_SIZE) {
119
		RSAerror(RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
120
		return 0;
121
	}
122
20296
	if (type != NID_md5_sha1) {
123
145
		tmps = malloc(j + 1);
124
145
		if (tmps == NULL) {
125
			RSAerror(ERR_R_MALLOC_FAILURE);
126
			return 0;
127
		}
128
145
		p = tmps;
129
145
		i2d_X509_SIG(&sig, &p);
130
		s = tmps;
131
145
	}
132
20296
	i = RSA_private_encrypt(i, s, sigret, rsa, RSA_PKCS1_PADDING);
133
20296
	if (i <= 0)
134
		ret = 0;
135
	else
136
20296
		*siglen = i;
137
138
20296
	if (type != NID_md5_sha1)
139
145
		freezero(tmps, (unsigned int)j + 1);
140
20296
	return (ret);
141
20296
}
142
143
int
144
int_rsa_verify(int dtype, const unsigned char *m, unsigned int m_len,
145
    unsigned char *rm, size_t *prm_len, const unsigned char *sigbuf,
146
    size_t siglen, RSA *rsa)
147
{
148
	int i, ret = 0, sigtype;
149
	unsigned char *s;
150
	X509_SIG *sig = NULL;
151
152
684012
	if (siglen != (unsigned int)RSA_size(rsa)) {
153
		RSAerror(RSA_R_WRONG_SIGNATURE_LENGTH);
154
		return 0;
155
	}
156
157
342006
	if ((dtype == NID_md5_sha1) && rm) {
158
		i = RSA_public_decrypt((int)siglen, sigbuf, rm, rsa,
159
		    RSA_PKCS1_PADDING);
160
		if (i <= 0)
161
			return 0;
162
		*prm_len = i;
163
		return 1;
164
	}
165
166
342006
	s = malloc(siglen);
167
342006
	if (s == NULL) {
168
		RSAerror(ERR_R_MALLOC_FAILURE);
169
		goto err;
170
	}
171
342006
	if (dtype == NID_md5_sha1 && m_len != SSL_SIG_LENGTH) {
172
		RSAerror(RSA_R_INVALID_MESSAGE_LENGTH);
173
		goto err;
174
	}
175
342006
	i = RSA_public_decrypt((int)siglen, sigbuf, s, rsa, RSA_PKCS1_PADDING);
176
177
342006
	if (i <= 0)
178
		goto err;
179
180
	/* Special case: SSL signature */
181
342006
	if (dtype == NID_md5_sha1) {
182

678880
		if (i != SSL_SIG_LENGTH || memcmp(s, m, SSL_SIG_LENGTH))
183
			RSAerror(RSA_R_BAD_SIGNATURE);
184
		else
185
			ret = 1;
186
	} else {
187
2566
		const unsigned char *p = s;
188
189
2566
		sig = d2i_X509_SIG(NULL, &p, (long)i);
190
191
2566
		if (sig == NULL)
192
			goto err;
193
194
		/* Excess data can be used to create forgeries */
195
2566
		if (p != s + i) {
196
			RSAerror(RSA_R_BAD_SIGNATURE);
197
			goto err;
198
		}
199
200
		/* Parameters to the signature algorithm can also be used to
201
		   create forgeries */
202

5132
		if (sig->algor->parameter &&
203
2566
		    ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) {
204
			RSAerror(RSA_R_BAD_SIGNATURE);
205
			goto err;
206
		}
207
208
2566
		sigtype = OBJ_obj2nid(sig->algor->algorithm);
209
210
2566
		if (sigtype != dtype) {
211
			RSAerror(RSA_R_ALGORITHM_MISMATCH);
212
			goto err;
213
		}
214
2566
		if (rm) {
215
			const EVP_MD *md;
216
217
			md = EVP_get_digestbynid(dtype);
218
			if (md && (EVP_MD_size(md) != sig->digest->length))
219
				RSAerror(RSA_R_INVALID_DIGEST_LENGTH);
220
			else {
221
				memcpy(rm, sig->digest->data,
222
				    sig->digest->length);
223
				*prm_len = sig->digest->length;
224
				ret = 1;
225
			}
226

5132
		} else if ((unsigned int)sig->digest->length != m_len ||
227
2566
		    memcmp(m, sig->digest->data, m_len) != 0) {
228
			RSAerror(RSA_R_BAD_SIGNATURE);
229
		} else
230
			ret = 1;
231
7728
	}
232
err:
233
342006
	X509_SIG_free(sig);
234
342006
	freezero(s, (unsigned int)siglen);
235
342006
	return ret;
236
342006
}
237
238
int
239
RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
240
    const unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
241
{
242

684012
	if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify)
243
		return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen,
244
		    rsa);
245
246
342006
	return int_rsa_verify(dtype, m, m_len, NULL, NULL, sigbuf, siglen, rsa);
247
342006
}