1 /* $Cambridge: exim/src/src/pdkim/rsa.c,v 1.1.2.1 2009/02/24 13:13:47 tom Exp $ */
3 * The RSA public-key cryptosystem
5 * Based on XySSL: Copyright (C) 2006-2008 Christophe Devine
7 * Copyright (C) 2009 Paul Bakker <polarssl_maintainer at polarssl dot org>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman.
26 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf
27 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf
38 * Initialize an RSA context
40 void rsa_init( rsa_context *ctx,
46 memset( ctx, 0, sizeof( rsa_context ) );
48 ctx->padding = padding;
49 ctx->hash_id = hash_id;
57 * Check a public RSA key
59 int rsa_check_pubkey( rsa_context *ctx )
61 if( ( ctx->N.p[0] & 1 ) == 0 ||
62 ( ctx->E.p[0] & 1 ) == 0 )
63 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED );
65 if( mpi_msb( &ctx->N ) < 128 ||
66 mpi_msb( &ctx->N ) > 4096 )
67 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED );
69 if( mpi_msb( &ctx->E ) < 2 ||
70 mpi_msb( &ctx->E ) > 64 )
71 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED );
77 * Check a private RSA key
79 int rsa_check_privkey( rsa_context *ctx )
82 mpi PQ, DE, P1, Q1, H, I, G;
84 if( ( ret = rsa_check_pubkey( ctx ) ) != 0 )
87 mpi_init( &PQ, &DE, &P1, &Q1, &H, &I, &G, NULL );
89 MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
90 MPI_CHK( mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
91 MPI_CHK( mpi_sub_int( &P1, &ctx->P, 1 ) );
92 MPI_CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) );
93 MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) );
94 MPI_CHK( mpi_mod_mpi( &I, &DE, &H ) );
95 MPI_CHK( mpi_gcd( &G, &ctx->E, &H ) );
97 if( mpi_cmp_mpi( &PQ, &ctx->N ) == 0 &&
98 mpi_cmp_int( &I, 1 ) == 0 &&
99 mpi_cmp_int( &G, 1 ) == 0 )
101 mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, NULL );
107 mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, NULL );
108 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED | ret );
112 * Do an RSA public key operation
114 int rsa_public( rsa_context *ctx,
115 unsigned char *input,
116 unsigned char *output )
121 mpi_init( &T, NULL );
123 MPI_CHK( mpi_read_binary( &T, input, ctx->len ) );
125 if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
127 mpi_free( &T, NULL );
128 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
132 MPI_CHK( mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
133 MPI_CHK( mpi_write_binary( &T, output, olen ) );
137 mpi_free( &T, NULL );
140 return( POLARSSL_ERR_RSA_PUBLIC_FAILED | ret );
146 * Do an RSA private key operation
148 int rsa_private( rsa_context *ctx,
149 unsigned char *input,
150 unsigned char *output )
155 mpi_init( &T, &T1, &T2, NULL );
157 MPI_CHK( mpi_read_binary( &T, input, ctx->len ) );
159 if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
161 mpi_free( &T, NULL );
162 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
166 MPI_CHK( mpi_exp_mod( &T, &T, &ctx->D, &ctx->N, &ctx->RN ) );
169 * faster decryption using the CRT
171 * T1 = input ^ dP mod P
172 * T2 = input ^ dQ mod Q
174 MPI_CHK( mpi_exp_mod( &T1, &T, &ctx->DP, &ctx->P, &ctx->RP ) );
175 MPI_CHK( mpi_exp_mod( &T2, &T, &ctx->DQ, &ctx->Q, &ctx->RQ ) );
178 * T = (T1 - T2) * (Q^-1 mod P) mod P
180 MPI_CHK( mpi_sub_mpi( &T, &T1, &T2 ) );
181 MPI_CHK( mpi_mul_mpi( &T1, &T, &ctx->QP ) );
182 MPI_CHK( mpi_mod_mpi( &T, &T1, &ctx->P ) );
185 * output = T2 + T * Q
187 MPI_CHK( mpi_mul_mpi( &T1, &T, &ctx->Q ) );
188 MPI_CHK( mpi_add_mpi( &T, &T2, &T1 ) );
192 MPI_CHK( mpi_write_binary( &T, output, olen ) );
196 mpi_free( &T, &T1, &T2, NULL );
199 return( POLARSSL_ERR_RSA_PRIVATE_FAILED | ret );
205 * Add the message padding, then do an RSA operation
207 int rsa_pkcs1_encrypt( rsa_context *ctx,
209 unsigned char *input,
210 unsigned char *output )
213 unsigned char *p = output;
217 switch( ctx->padding )
221 if( ilen < 0 || olen < ilen + 11 )
222 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
224 nb_pad = olen - 3 - ilen;
229 while( nb_pad-- > 0 )
232 *p = (unsigned char) rand();
237 memcpy( p, input, ilen );
242 return( POLARSSL_ERR_RSA_INVALID_PADDING );
245 return( ( mode == RSA_PUBLIC )
246 ? rsa_public( ctx, output, output )
247 : rsa_private( ctx, output, output ) );
251 * Do an RSA operation, then remove the message padding
253 int rsa_pkcs1_decrypt( rsa_context *ctx,
255 unsigned char *input,
256 unsigned char *output,
261 unsigned char buf[512];
265 if( ilen < 16 || ilen > (int) sizeof( buf ) )
266 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
268 ret = ( mode == RSA_PUBLIC )
269 ? rsa_public( ctx, input, buf )
270 : rsa_private( ctx, input, buf );
277 switch( ctx->padding )
281 if( *p++ != 0 || *p++ != RSA_CRYPT )
282 return( POLARSSL_ERR_RSA_INVALID_PADDING );
286 if( p >= buf + ilen - 1 )
287 return( POLARSSL_ERR_RSA_INVALID_PADDING );
295 return( POLARSSL_ERR_RSA_INVALID_PADDING );
298 if (ilen - (int)(p - buf) > output_max_len)
299 return( POLARSSL_ERR_RSA_OUTPUT_TO_LARGE );
301 *olen = ilen - (int)(p - buf);
302 memcpy( output, p, *olen );
308 * Do an RSA operation to sign the message digest
310 int rsa_pkcs1_sign( rsa_context *ctx,
318 unsigned char *p = sig;
322 switch( ctx->padding )
329 nb_pad = olen - 3 - hashlen;
335 nb_pad = olen - 3 - 16 - 18;
339 nb_pad = olen - 3 - 20 - 15;
343 nb_pad = olen - 3 - 32 - 19;
347 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
351 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
355 memset( p, 0xFF, nb_pad );
362 return( POLARSSL_ERR_RSA_INVALID_PADDING );
368 memcpy( p, hash, hashlen );
372 memcpy( p, ASN1_HASH_MDX, 18 );
373 memcpy( p + 18, hash, 16 );
377 memcpy( p, ASN1_HASH_MDX, 18 );
378 memcpy( p + 18, hash, 16 );
382 memcpy( p, ASN1_HASH_MDX, 18 );
383 memcpy( p + 18, hash, 16 );
387 memcpy( p, ASN1_HASH_SHA1, 15 );
388 memcpy( p + 15, hash, 20 );
392 memcpy( p, ASN1_HASH_SHA256, 19 );
393 memcpy( p + 19, hash, 32 );
397 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
400 return( ( mode == RSA_PUBLIC )
401 ? rsa_public( ctx, sig, sig )
402 : rsa_private( ctx, sig, sig ) );
406 * Do an RSA operation and check the message digest
408 int rsa_pkcs1_verify( rsa_context *ctx,
415 int ret, len, siglen;
417 unsigned char buf[512];
421 if( siglen < 16 || siglen > (int) sizeof( buf ) )
422 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
424 ret = ( mode == RSA_PUBLIC )
425 ? rsa_public( ctx, sig, buf )
426 : rsa_private( ctx, sig, buf );
433 switch( ctx->padding )
437 if( *p++ != 0 || *p++ != RSA_SIGN )
438 return( POLARSSL_ERR_RSA_INVALID_PADDING );
442 if( p >= buf + siglen - 1 || *p != 0xFF )
443 return( POLARSSL_ERR_RSA_INVALID_PADDING );
451 return( POLARSSL_ERR_RSA_INVALID_PADDING );
454 len = siglen - (int)( p - buf );
461 if( memcmp( p, ASN1_HASH_MDX, 18 ) != 0 )
462 return( POLARSSL_ERR_RSA_VERIFY_FAILED );
464 if( ( c == 2 && hash_id == RSA_MD2 ) ||
465 ( c == 4 && hash_id == RSA_MD4 ) ||
466 ( c == 5 && hash_id == RSA_MD5 ) )
468 if( memcmp( p + 18, hash, 16 ) == 0 )
471 return( POLARSSL_ERR_RSA_VERIFY_FAILED );
475 if( len == 35 && hash_id == RSA_SHA1 )
477 if( memcmp( p, ASN1_HASH_SHA1, 15 ) == 0 &&
478 memcmp( p + 15, hash, 20 ) == 0 )
481 return( POLARSSL_ERR_RSA_VERIFY_FAILED );
484 if( len == hashlen && hash_id == RSA_RAW )
486 if( memcmp( p, hash, hashlen ) == 0 )
489 return( POLARSSL_ERR_RSA_VERIFY_FAILED );
492 return( POLARSSL_ERR_RSA_INVALID_PADDING );
496 * Free the components of an RSA key
498 void rsa_free( rsa_context *ctx )
500 mpi_free( &ctx->RQ, &ctx->RP, &ctx->RN,
501 &ctx->QP, &ctx->DQ, &ctx->DP,
502 &ctx->Q, &ctx->P, &ctx->D,
503 &ctx->E, &ctx->N, NULL );
507 * ASN.1 DER decoding routines
509 static int asn1_get_len( unsigned char **p,
513 if( ( end - *p ) < 1 )
514 return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
516 if( ( **p & 0x80 ) == 0 )
523 if( ( end - *p ) < 2 )
524 return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
531 if( ( end - *p ) < 3 )
532 return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
534 *len = ( (*p)[1] << 8 ) | (*p)[2];
539 return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
544 if( *len > (int) ( end - *p ) )
545 return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
550 static int asn1_get_tag( unsigned char **p,
554 if( ( end - *p ) < 1 )
555 return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
558 return( POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
562 return( asn1_get_len( p, end, len ) );
565 static int asn1_get_int( unsigned char **p,
571 if( ( ret = asn1_get_tag( p, end, &len, ASN1_INTEGER ) ) != 0 )
574 if( len > (int) sizeof( int ) || ( **p & 0x80 ) != 0 )
575 return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
581 *val = ( *val << 8 ) | **p;
588 static int asn1_get_mpi( unsigned char **p,
594 if( ( ret = asn1_get_tag( p, end, &len, ASN1_INTEGER ) ) != 0 )
597 ret = mpi_read_binary( X, *p, len );
606 * Parse a private RSA key
608 int rsa_parse_key( rsa_context *rsa, unsigned char *buf, int buflen,
609 unsigned char *pwd, int pwdlen )
612 unsigned char *s1, *s2;
613 unsigned char *p, *end;
615 s1 = (unsigned char *) strstr( (char *) buf,
616 "-----BEGIN RSA PRIVATE KEY-----" );
620 s2 = (unsigned char *) strstr( (char *) buf,
621 "-----END RSA PRIVATE KEY-----" );
623 if( s2 == NULL || s2 <= s1 )
624 return( POLARSSL_ERR_X509_KEY_INVALID_PEM );
627 if( *s1 == '\r' ) s1++;
628 if( *s1 == '\n' ) s1++;
629 else return( POLARSSL_ERR_X509_KEY_INVALID_PEM );
633 if( memcmp( s1, "Proc-Type: 4,ENCRYPTED", 22 ) == 0 )
635 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE );
639 ret = base64_decode( NULL, &len, s1, s2 - s1 );
641 if( ret == POLARSSL_ERR_BASE64_INVALID_CHARACTER )
642 return( ret | POLARSSL_ERR_X509_KEY_INVALID_PEM );
644 if( ( buf = (unsigned char *) malloc( len ) ) == NULL )
647 if( ( ret = base64_decode( buf, &len, s1, s2 - s1 ) ) != 0 )
650 return( ret | POLARSSL_ERR_X509_KEY_INVALID_PEM );
657 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE );
661 memset( rsa, 0, sizeof( rsa_context ) );
667 * RSAPrivateKey ::= SEQUENCE {
669 * modulus INTEGER, -- n
670 * publicExponent INTEGER, -- e
671 * privateExponent INTEGER, -- d
672 * prime1 INTEGER, -- p
673 * prime2 INTEGER, -- q
674 * exponent1 INTEGER, -- d mod (p-1)
675 * exponent2 INTEGER, -- d mod (q-1)
676 * coefficient INTEGER, -- (inverse of q) mod p
677 * otherPrimeInfos OtherPrimeInfos OPTIONAL
680 if( ( ret = asn1_get_tag( &p, end, &len,
681 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
687 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
692 if( ( ret = asn1_get_int( &p, end, &rsa->ver ) ) != 0 )
698 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
707 return( ret | POLARSSL_ERR_X509_KEY_INVALID_VERSION );
710 if( ( ret = asn1_get_mpi( &p, end, &rsa->N ) ) != 0 ||
711 ( ret = asn1_get_mpi( &p, end, &rsa->E ) ) != 0 ||
712 ( ret = asn1_get_mpi( &p, end, &rsa->D ) ) != 0 ||
713 ( ret = asn1_get_mpi( &p, end, &rsa->P ) ) != 0 ||
714 ( ret = asn1_get_mpi( &p, end, &rsa->Q ) ) != 0 ||
715 ( ret = asn1_get_mpi( &p, end, &rsa->DP ) ) != 0 ||
716 ( ret = asn1_get_mpi( &p, end, &rsa->DQ ) ) != 0 ||
717 ( ret = asn1_get_mpi( &p, end, &rsa->QP ) ) != 0 )
723 return( ret | POLARSSL_ERR_X509_KEY_INVALID_FORMAT );
726 rsa->len = mpi_size( &rsa->N );
734 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT |
735 POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
738 if( ( ret = rsa_check_privkey( rsa ) ) != 0 )