1
/* crypto/rsa/rsa_eay.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5
* This package is an SSL implementation written
6
* by Eric Young (eay@cryptsoft.com).
7
* The implementation was written so as to conform with Netscapes SSL.
9
* This library is free for commercial and non-commercial use as long as
10
* the following conditions are aheared to. The following conditions
11
* apply to all code found in this distribution, be it the RC4, RSA,
12
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
13
* included with this distribution is covered by the same copyright terms
14
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
16
* Copyright remains Eric Young's, and as such any Copyright notices in
17
* the code are not to be removed.
18
* If this package is used in a product, Eric Young should be given attribution
19
* as the author of the parts of the library used.
20
* This can be in the form of a textual message at program startup or
21
* in documentation (online or textual) provided with the package.
23
* Redistribution and use in source and binary forms, with or without
24
* modification, are permitted provided that the following conditions
26
* 1. Redistributions of source code must retain the copyright
27
* notice, this list of conditions and the following disclaimer.
28
* 2. Redistributions in binary form must reproduce the above copyright
29
* notice, this list of conditions and the following disclaimer in the
30
* documentation and/or other materials provided with the distribution.
31
* 3. All advertising materials mentioning features or use of this software
32
* must display the following acknowledgement:
33
* "This product includes cryptographic software written by
34
* Eric Young (eay@cryptsoft.com)"
35
* The word 'cryptographic' can be left out if the rouines from the library
36
* being used are not cryptographic related :-).
37
* 4. If you include any Windows specific code (or a derivative thereof) from
38
* the apps directory (application code) you must include an acknowledgement:
39
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53
* The licence and distribution terms for any publically available version or
54
* derivative of this code cannot be changed. i.e. this code cannot simply be
55
* copied and put under another distribution licence
56
* [including the GNU Public Licence.]
58
/* ====================================================================
59
* Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
61
* Redistribution and use in source and binary forms, with or without
62
* modification, are permitted provided that the following conditions
65
* 1. Redistributions of source code must retain the above copyright
66
* notice, this list of conditions and the following disclaimer.
68
* 2. Redistributions in binary form must reproduce the above copyright
69
* notice, this list of conditions and the following disclaimer in
70
* the documentation and/or other materials provided with the
73
* 3. All advertising materials mentioning features or use of this
74
* software must display the following acknowledgment:
75
* "This product includes software developed by the OpenSSL Project
76
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79
* endorse or promote products derived from this software without
80
* prior written permission. For written permission, please contact
81
* openssl-core@openssl.org.
83
* 5. Products derived from this software may not be called "OpenSSL"
84
* nor may "OpenSSL" appear in their names without prior written
85
* permission of the OpenSSL Project.
87
* 6. Redistributions of any form whatsoever must retain the following
89
* "This product includes software developed by the OpenSSL Project
90
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103
* OF THE POSSIBILITY OF SUCH DAMAGE.
104
* ====================================================================
106
* This product includes cryptographic software written by Eric Young
107
* (eay@cryptsoft.com). This product includes software written by Tim
108
* Hudson (tjh@cryptsoft.com).
113
#include <openssl/bn.h>
114
#include <openssl/rsa.h>
115
#include <openssl/rand.h>
116
#include <openssl/err.h>
117
#include <openssl/fips.h>
119
#if !defined(RSA_NULL) && defined(OPENSSL_FIPS)
121
static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
122
unsigned char *to, RSA *rsa,int padding);
123
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
124
unsigned char *to, RSA *rsa,int padding);
125
static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
126
unsigned char *to, RSA *rsa,int padding);
127
static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
128
unsigned char *to, RSA *rsa,int padding);
129
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx);
130
static int RSA_eay_init(RSA *rsa);
131
static int RSA_eay_finish(RSA *rsa);
132
static RSA_METHOD rsa_pkcs1_eay_meth={
133
"Eric Young's PKCS#1 RSA",
134
RSA_eay_public_encrypt,
135
RSA_eay_public_decrypt, /* signature verification */
136
RSA_eay_private_encrypt, /* signing */
137
RSA_eay_private_decrypt,
139
BN_mod_exp_mont, /* XXX probably we should not use Montgomery if e == 3 */
142
RSA_FLAG_FIPS_METHOD, /* flags */
146
NULL /* rsa_keygen */
149
const RSA_METHOD *RSA_PKCS1_SSLeay(void)
151
return(&rsa_pkcs1_eay_meth);
155
* MONT_HELPER(rsa, bn_ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
157
#define MONT_HELPER(rsa, ctx, m, pre_cond, err_instr) \
158
if((pre_cond) && ((rsa)->_method_mod_##m == NULL) && \
159
!BN_MONT_CTX_set_locked(&((rsa)->_method_mod_##m), \
164
static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
165
unsigned char *to, RSA *rsa, int padding)
168
int i,j,k,num=0,r= -1;
169
unsigned char *buf=NULL;
172
if(FIPS_selftest_failed())
174
FIPSerr(FIPS_F_RSA_EAY_PUBLIC_ENCRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
178
if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
180
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
184
if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
186
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
190
if (BN_ucmp(rsa->n, rsa->e) <= 0)
192
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
196
/* for large moduli, enforce exponent limit */
197
if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
199
if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
201
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
206
if ((ctx=BN_CTX_new()) == NULL) goto err;
209
ret = BN_CTX_get(ctx);
210
num=BN_num_bytes(rsa->n);
211
buf = OPENSSL_malloc(num);
212
if (!f || !ret || !buf)
214
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);
220
case RSA_PKCS1_PADDING:
221
i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);
223
#ifndef OPENSSL_NO_SHA
224
case RSA_PKCS1_OAEP_PADDING:
225
i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);
228
case RSA_SSLV23_PADDING:
229
i=RSA_padding_add_SSLv23(buf,num,from,flen);
232
i=RSA_padding_add_none(buf,num,from,flen);
235
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
238
if (i <= 0) goto err;
240
if (BN_bin2bn(buf,num,f) == NULL) goto err;
242
if (BN_ucmp(f, rsa->n) >= 0)
244
/* usually the padding functions would catch this */
245
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
249
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
251
if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
252
rsa->_method_mod_n)) goto err;
254
/* put in leading 0 bytes if the number is less than the
255
* length of the modulus */
257
i=BN_bn2bin(ret,&(to[num-j]));
258
for (k=0; k<(num-i); k++)
270
OPENSSL_cleanse(buf,num);
276
static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
279
int got_write_lock = 0;
281
CRYPTO_r_lock(CRYPTO_LOCK_RSA);
283
if (rsa->blinding == NULL)
285
CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
286
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
289
if (rsa->blinding == NULL)
290
rsa->blinding = RSA_setup_blinding(rsa, ctx);
297
if (BN_BLINDING_get_thread_id(ret) == CRYPTO_thread_id())
299
/* rsa->blinding is ours! */
305
/* resort to rsa->mt_blinding instead */
307
*local = 0; /* instructs rsa_blinding_convert(), rsa_blinding_invert()
308
* that the BN_BLINDING is shared, meaning that accesses
309
* require locks, and that the blinding factor must be
310
* stored outside the BN_BLINDING
313
if (rsa->mt_blinding == NULL)
317
CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
318
CRYPTO_w_lock(CRYPTO_LOCK_RSA);
322
if (rsa->mt_blinding == NULL)
323
rsa->mt_blinding = RSA_setup_blinding(rsa, ctx);
325
ret = rsa->mt_blinding;
330
CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
332
CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
336
static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
337
BIGNUM *r, BN_CTX *ctx)
340
return BN_BLINDING_convert_ex(f, NULL, b, ctx);
344
CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
345
ret = BN_BLINDING_convert_ex(f, r, b, ctx);
346
CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
351
static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
352
BIGNUM *r, BN_CTX *ctx)
355
return BN_BLINDING_invert_ex(f, NULL, b, ctx);
359
CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
360
ret = BN_BLINDING_invert_ex(f, r, b, ctx);
361
CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
367
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
368
unsigned char *to, RSA *rsa, int padding)
370
BIGNUM *f, *ret, *br, *res;
371
int i,j,k,num=0,r= -1;
372
unsigned char *buf=NULL;
374
int local_blinding = 0;
375
BN_BLINDING *blinding = NULL;
377
if(FIPS_selftest_failed())
379
FIPSerr(FIPS_F_RSA_EAY_PRIVATE_ENCRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
383
if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
385
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
389
if ((ctx=BN_CTX_new()) == NULL) goto err;
392
br = BN_CTX_get(ctx);
393
ret = BN_CTX_get(ctx);
394
num = BN_num_bytes(rsa->n);
395
buf = OPENSSL_malloc(num);
396
if(!f || !ret || !buf)
398
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
404
case RSA_PKCS1_PADDING:
405
i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen);
407
case RSA_X931_PADDING:
408
i=RSA_padding_add_X931(buf,num,from,flen);
411
i=RSA_padding_add_none(buf,num,from,flen);
413
case RSA_SSLV23_PADDING:
415
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
418
if (i <= 0) goto err;
420
if (BN_bin2bn(buf,num,f) == NULL) goto err;
422
if (BN_ucmp(f, rsa->n) >= 0)
424
/* usually the padding functions would catch this */
425
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
429
if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
431
blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
432
if (blinding == NULL)
434
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
439
if (blinding != NULL)
440
if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
443
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
446
(rsa->dmp1 != NULL) &&
447
(rsa->dmq1 != NULL) &&
448
(rsa->iqmp != NULL)) )
450
if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
457
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
461
BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
466
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
468
if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
469
rsa->_method_mod_n)) goto err;
473
if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
476
if (padding == RSA_X931_PADDING)
478
BN_sub(f, rsa->n, ret);
487
/* put in leading 0 bytes if the number is less than the
488
* length of the modulus */
490
i=BN_bn2bin(res,&(to[num-j]));
491
for (k=0; k<(num-i); k++)
503
OPENSSL_cleanse(buf,num);
509
static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
510
unsigned char *to, RSA *rsa, int padding)
512
BIGNUM *f, *ret, *br;
515
unsigned char *buf=NULL;
517
int local_blinding = 0;
518
BN_BLINDING *blinding = NULL;
520
if(FIPS_selftest_failed())
522
FIPSerr(FIPS_F_RSA_EAY_PRIVATE_DECRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
526
if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
528
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
532
if((ctx = BN_CTX_new()) == NULL) goto err;
535
br = BN_CTX_get(ctx);
536
ret = BN_CTX_get(ctx);
537
num = BN_num_bytes(rsa->n);
538
buf = OPENSSL_malloc(num);
539
if(!f || !ret || !buf)
541
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
545
/* This check was for equality but PGP does evil things
546
* and chops off the top '0' bytes */
549
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
553
/* make data into a big number */
554
if (BN_bin2bn(from,(int)flen,f) == NULL) goto err;
556
if (BN_ucmp(f, rsa->n) >= 0)
558
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
562
if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
564
blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
565
if (blinding == NULL)
567
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
572
if (blinding != NULL)
573
if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
577
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
580
(rsa->dmp1 != NULL) &&
581
(rsa->dmq1 != NULL) &&
582
(rsa->iqmp != NULL)) )
584
if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
591
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
594
BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
599
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
600
if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
606
if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
610
j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */
614
case RSA_PKCS1_PADDING:
615
r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num);
617
#ifndef OPENSSL_NO_SHA
618
case RSA_PKCS1_OAEP_PADDING:
619
r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0);
622
case RSA_SSLV23_PADDING:
623
r=RSA_padding_check_SSLv23(to,num,buf,j,num);
626
r=RSA_padding_check_none(to,num,buf,j,num);
629
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
633
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
643
OPENSSL_cleanse(buf,num);
649
/* signature verification */
650
static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
651
unsigned char *to, RSA *rsa, int padding)
656
unsigned char *buf=NULL;
659
if(FIPS_selftest_failed())
661
FIPSerr(FIPS_F_RSA_EAY_PUBLIC_DECRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
665
if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
667
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
671
if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
673
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
677
if (BN_ucmp(rsa->n, rsa->e) <= 0)
679
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
683
/* for large moduli, enforce exponent limit */
684
if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
686
if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
688
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);
693
if((ctx = BN_CTX_new()) == NULL) goto err;
696
ret = BN_CTX_get(ctx);
697
num=BN_num_bytes(rsa->n);
698
buf = OPENSSL_malloc(num);
699
if(!f || !ret || !buf)
701
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);
705
/* This check was for equality but PGP does evil things
706
* and chops off the top '0' bytes */
709
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
713
if (BN_bin2bn(from,flen,f) == NULL) goto err;
715
if (BN_ucmp(f, rsa->n) >= 0)
717
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
721
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
723
if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
724
rsa->_method_mod_n)) goto err;
726
if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))
727
BN_sub(ret, rsa->n, ret);
734
case RSA_PKCS1_PADDING:
735
r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);
737
case RSA_X931_PADDING:
738
r=RSA_padding_check_X931(to,num,buf,i,num);
741
r=RSA_padding_check_none(to,num,buf,i,num);
744
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
748
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
758
OPENSSL_cleanse(buf,num);
764
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
766
BIGNUM *r1,*m1,*vrfy;
767
BIGNUM local_dmp1,local_dmq1,local_c,local_r1;
768
BIGNUM *dmp1,*dmq1,*c,*pr1;
773
r1 = BN_CTX_get(ctx);
774
m1 = BN_CTX_get(ctx);
775
vrfy = BN_CTX_get(ctx);
777
/* Make sure mod_inverse in montgomerey intialization use correct
778
* BN_FLG_CONSTTIME flag.
780
bn_flags = rsa->p->flags;
781
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
783
rsa->p->flags |= BN_FLG_CONSTTIME;
785
MONT_HELPER(rsa, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
786
/* We restore bn_flags back */
787
rsa->p->flags = bn_flags;
789
/* Make sure mod_inverse in montgomerey intialization use correct
790
* BN_FLG_CONSTTIME flag.
792
bn_flags = rsa->q->flags;
793
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
795
rsa->q->flags |= BN_FLG_CONSTTIME;
797
MONT_HELPER(rsa, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
798
/* We restore bn_flags back */
799
rsa->q->flags = bn_flags;
801
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
803
/* compute I mod q */
804
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
807
BN_with_flags(c, I, BN_FLG_CONSTTIME);
808
if (!BN_mod(r1,c,rsa->q,ctx)) goto err;
812
if (!BN_mod(r1,I,rsa->q,ctx)) goto err;
815
/* compute r1^dmq1 mod q */
816
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
819
BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);
823
if (!rsa->meth->bn_mod_exp(m1,r1,dmq1,rsa->q,ctx,
824
rsa->_method_mod_q)) goto err;
826
/* compute I mod p */
827
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
830
BN_with_flags(c, I, BN_FLG_CONSTTIME);
831
if (!BN_mod(r1,c,rsa->p,ctx)) goto err;
835
if (!BN_mod(r1,I,rsa->p,ctx)) goto err;
838
/* compute r1^dmp1 mod p */
839
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
842
BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);
846
if (!rsa->meth->bn_mod_exp(r0,r1,dmp1,rsa->p,ctx,
847
rsa->_method_mod_p)) goto err;
849
if (!BN_sub(r0,r0,m1)) goto err;
850
/* This will help stop the size of r0 increasing, which does
851
* affect the multiply if it optimised for a power of 2 size */
852
if (BN_is_negative(r0))
853
if (!BN_add(r0,r0,rsa->p)) goto err;
855
if (!BN_mul(r1,r0,rsa->iqmp,ctx)) goto err;
857
/* Turn BN_FLG_CONSTTIME flag on before division operation */
858
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
861
BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
865
if (!BN_mod(r0,pr1,rsa->p,ctx)) goto err;
867
/* If p < q it is occasionally possible for the correction of
868
* adding 'p' if r0 is negative above to leave the result still
869
* negative. This can break the private key operations: the following
870
* second correction should *always* correct this rare occurrence.
871
* This will *never* happen with OpenSSL generated keys because
872
* they ensure p > q [steve]
874
if (BN_is_negative(r0))
875
if (!BN_add(r0,r0,rsa->p)) goto err;
876
if (!BN_mul(r1,r0,rsa->q,ctx)) goto err;
877
if (!BN_add(r0,r1,m1)) goto err;
879
if (rsa->e && rsa->n)
881
if (!rsa->meth->bn_mod_exp(vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) goto err;
882
/* If 'I' was greater than (or equal to) rsa->n, the operation
883
* will be equivalent to using 'I mod n'. However, the result of
884
* the verify will *always* be less than 'n' so we don't check
885
* for absolute equality, just congruency. */
886
if (!BN_sub(vrfy, vrfy, I)) goto err;
887
if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) goto err;
888
if (BN_is_negative(vrfy))
889
if (!BN_add(vrfy, vrfy, rsa->n)) goto err;
890
if (!BN_is_zero(vrfy))
892
/* 'I' and 'vrfy' aren't congruent mod n. Don't leak
893
* miscalculated CRT output, just do a raw (slower)
894
* mod_exp and return that instead. */
899
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
902
BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
906
if (!rsa->meth->bn_mod_exp(r0,I,d,rsa->n,ctx,
907
rsa->_method_mod_n)) goto err;
916
static int RSA_eay_init(RSA *rsa)
918
FIPS_selftest_check();
919
rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE;
923
static int RSA_eay_finish(RSA *rsa)
925
if (rsa->_method_mod_n != NULL)
926
BN_MONT_CTX_free(rsa->_method_mod_n);
927
if (rsa->_method_mod_p != NULL)
928
BN_MONT_CTX_free(rsa->_method_mod_p);
929
if (rsa->_method_mod_q != NULL)
930
BN_MONT_CTX_free(rsa->_method_mod_q);
added
removed
fips/rsa/fips_rsa_eay.c
