crypto/rsassa-pkcs1.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * RSA Signature Scheme with Appendix - PKCS #1 v1.5 (RFC 8017 sec 8.2)
   4  *
   5  * https://www.rfc-editor.org/rfc/rfc8017#section-8.2
   6  *
   7  * Copyright (c) 2015 - 2024 Intel Corporation
   8  */
   9
  10 #include <linux/module.h>
  11 #include <linux/scatterlist.h>
  12 #include <crypto/akcipher.h>
  13 #include <crypto/algapi.h>
  14 #include <crypto/hash.h>
  15 #include <crypto/sig.h>
  16 #include <crypto/internal/akcipher.h>
  17 #include <crypto/internal/rsa.h>
  18 #include <crypto/internal/sig.h>
  19
  20 /*
  21  * Full Hash Prefix for EMSA-PKCS1-v1_5 encoding method (RFC 9580 table 24)
  22  *
  23  * RSA keys are usually much larger than the hash of the message to be signed.
  24  * The hash is therefore prepended by the Full Hash Prefix and a 0xff padding.
  25  * The Full Hash Prefix is an ASN.1 SEQUENCE containing the hash algorithm OID.
  26  *
  27  * https://www.rfc-editor.org/rfc/rfc9580#table-24
  28  */
  29
  30 static const u8 hash_prefix_none[] = { };
  31
  32 static const u8 hash_prefix_md5[] = {
  33         0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,       /* SEQUENCE (SEQUENCE (OID */
  34         0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /*      <algorithm>, */
  35         0x05, 0x00, 0x04, 0x10                /* NULL), OCTET STRING <hash>) */
  36 };
  37
  38 static const u8 hash_prefix_sha1[] = {
  39         0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  40         0x2b, 0x0e, 0x03, 0x02, 0x1a,
  41         0x05, 0x00, 0x04, 0x14
  42 };
  43
  44 static const u8 hash_prefix_rmd160[] = {
  45         0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
  46         0x2b, 0x24, 0x03, 0x02, 0x01,
  47         0x05, 0x00, 0x04, 0x14
  48 };
  49
  50 static const u8 hash_prefix_sha224[] = {
  51         0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
  52         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
  53         0x05, 0x00, 0x04, 0x1c
  54 };
  55
  56 static const u8 hash_prefix_sha256[] = {
  57         0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
  58         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
  59         0x05, 0x00, 0x04, 0x20
  60 };
  61
  62 static const u8 hash_prefix_sha384[] = {
  63         0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
  64         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
  65         0x05, 0x00, 0x04, 0x30
  66 };
  67
  68 static const u8 hash_prefix_sha512[] = {
  69         0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
  70         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
  71         0x05, 0x00, 0x04, 0x40
  72 };
  73
  74 static const u8 hash_prefix_sha3_256[] = {
  75         0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
  76         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08,
  77         0x05, 0x00, 0x04, 0x20
  78 };
  79
  80 static const u8 hash_prefix_sha3_384[] = {
  81         0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
  82         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09,
  83         0x05, 0x00, 0x04, 0x30
  84 };
  85
  86 static const u8 hash_prefix_sha3_512[] = {
  87         0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
  88         0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0a,
  89         0x05, 0x00, 0x04, 0x40
  90 };
  91
  92 static const struct hash_prefix {
  93         const char      *name;
  94         const u8        *data;
  95         size_t          size;
  96 } hash_prefixes[] = {
  97 #define _(X) { #X, hash_prefix_##X, sizeof(hash_prefix_##X) }
  98         _(none),
  99         _(md5),
 100         _(sha1),
 101         _(rmd160),
 102         _(sha256),
 103         _(sha384),
 104         _(sha512),
 105         _(sha224),
 106 #undef _
 107 #define _(X) { "sha3-" #X, hash_prefix_sha3_##X, sizeof(hash_prefix_sha3_##X) }
 108         _(256),
 109         _(384),
 110         _(512),
 111 #undef _
 112         { NULL }
 113 };
 114
 115 static const struct hash_prefix *rsassa_pkcs1_find_hash_prefix(const char *name)
 116 {
 117         const struct hash_prefix *p;
 118
 119         for (p = hash_prefixes; p->name; p++)
 120                 if (strcmp(name, p->name) == 0)
 121                         return p;
 122         return NULL;
 123 }
 124
 125 static bool rsassa_pkcs1_invalid_hash_len(unsigned int len,
 126                                           const struct hash_prefix *p)
 127 {
 128         /*
 129          * Legacy protocols such as TLS 1.1 or earlier and IKE version 1
 130          * do not prepend a Full Hash Prefix to the hash.  In that case,
 131          * the size of the Full Hash Prefix is zero.
 132          */
 133         if (p->data == hash_prefix_none)
 134                 return false;
 135
 136         /*
 137          * The final byte of the Full Hash Prefix encodes the hash length.
 138          *
 139          * This needs to be revisited should hash algorithms with more than
 140          * 1016 bits (127 bytes * 8) ever be added.  The length would then
 141          * be encoded into more than one byte by ASN.1.
 142          */
 143         static_assert(HASH_MAX_DIGESTSIZE <= 127);
 144
 145         return len != p->data[p->size - 1];
 146 }
 147
 148 struct rsassa_pkcs1_ctx {
 149         struct crypto_akcipher *child;
 150         unsigned int key_size;
 151 };
 152
 153 struct rsassa_pkcs1_inst_ctx {
 154         struct crypto_akcipher_spawn spawn;
 155         const struct hash_prefix *hash_prefix;
 156 };
 157
 158 static int rsassa_pkcs1_sign(struct crypto_sig *tfm,
 159                              const void *src, unsigned int slen,
 160                              void *dst, unsigned int dlen)
 161 {
 162         struct sig_instance *inst = sig_alg_instance(tfm);
 163         struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
 164         const struct hash_prefix *hash_prefix = ictx->hash_prefix;
 165         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 166         unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child);
 167         struct akcipher_request *child_req __free(kfree_sensitive) = NULL;
 168         struct scatterlist in_sg[3], out_sg;
 169         struct crypto_wait cwait;
 170         unsigned int pad_len;
 171         unsigned int ps_end;
 172         unsigned int len;
 173         u8 *in_buf;
 174         int err;
 175
 176         if (!ctx->key_size)
 177                 return -EINVAL;
 178
 179         if (dlen < ctx->key_size)
 180                 return -EOVERFLOW;
 181
 182         if (rsassa_pkcs1_invalid_hash_len(slen, hash_prefix))
 183                 return -EINVAL;
 184
 185         if (slen + hash_prefix->size > ctx->key_size - 11)
 186                 return -EOVERFLOW;
 187
 188         pad_len = ctx->key_size - slen - hash_prefix->size - 1;
 189
 190         child_req = kmalloc(sizeof(*child_req) + child_reqsize + pad_len,
 191                             GFP_KERNEL);
 192         if (!child_req)
 193                 return -ENOMEM;
 194
 195         /* RFC 8017 sec 8.2.1 step 1 - EMSA-PKCS1-v1_5 encoding generation */
 196         in_buf = (u8 *)(child_req + 1) + child_reqsize;
 197         ps_end = pad_len - 1;
 198         in_buf[0] = 0x01;
 199         memset(in_buf + 1, 0xff, ps_end - 1);
 200         in_buf[ps_end] = 0x00;
 201
 202         /* RFC 8017 sec 8.2.1 step 2 - RSA signature */
 203         crypto_init_wait(&cwait);
 204         sg_init_table(in_sg, 3);
 205         sg_set_buf(&in_sg[0], in_buf, pad_len);
 206         sg_set_buf(&in_sg[1], hash_prefix->data, hash_prefix->size);
 207         sg_set_buf(&in_sg[2], src, slen);
 208         sg_init_one(&out_sg, dst, dlen);
 209         akcipher_request_set_tfm(child_req, ctx->child);
 210         akcipher_request_set_crypt(child_req, in_sg, &out_sg,
 211                                    ctx->key_size - 1, dlen);
 212         akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP,
 213                                       crypto_req_done, &cwait);
 214
 215         err = crypto_akcipher_decrypt(child_req);
 216         err = crypto_wait_req(err, &cwait);
 217         if (err)
 218                 return err;
 219
 220         len = child_req->dst_len;
 221         pad_len = ctx->key_size - len;
 222
 223         /* Four billion to one */
 224         if (unlikely(pad_len)) {
 225                 memmove(dst + pad_len, dst, len);
 226                 memset(dst, 0, pad_len);
 227         }
 228
 229         return 0;
 230 }
 231
 232 static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 233                                const void *src, unsigned int slen,
 234                                const void *digest, unsigned int dlen)
 235 {
 236         struct sig_instance *inst = sig_alg_instance(tfm);
 237         struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
 238         const struct hash_prefix *hash_prefix = ictx->hash_prefix;
 239         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 240         unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child);
 241         struct akcipher_request *child_req __free(kfree_sensitive) = NULL;
 242         struct scatterlist in_sg, out_sg;
 243         struct crypto_wait cwait;
 244         unsigned int dst_len;
 245         unsigned int pos;
 246         u8 *out_buf;
 247         int err;
 248
 249         /* RFC 8017 sec 8.2.2 step 1 - length checking */
 250         if (!ctx->key_size ||
 251             slen != ctx->key_size ||
 252             rsassa_pkcs1_invalid_hash_len(dlen, hash_prefix))
 253                 return -EINVAL;
 254
 255         /* RFC 8017 sec 8.2.2 step 2 - RSA verification */
 256         child_req = kmalloc(sizeof(*child_req) + child_reqsize + ctx->key_size,
 257                             GFP_KERNEL);
 258         if (!child_req)
 259                 return -ENOMEM;
 260
 261         out_buf = (u8 *)(child_req + 1) + child_reqsize;
 262
 263         crypto_init_wait(&cwait);
 264         sg_init_one(&in_sg, src, slen);
 265         sg_init_one(&out_sg, out_buf, ctx->key_size);
 266         akcipher_request_set_tfm(child_req, ctx->child);
 267         akcipher_request_set_crypt(child_req, &in_sg, &out_sg,
 268                                    slen, ctx->key_size);
 269         akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP,
 270                                       crypto_req_done, &cwait);
 271
 272         err = crypto_akcipher_encrypt(child_req);
 273         err = crypto_wait_req(err, &cwait);
 274         if (err)
 275                 return err;
 276
 277         /* RFC 8017 sec 8.2.2 step 3 - EMSA-PKCS1-v1_5 encoding verification */
 278         dst_len = child_req->dst_len;
 279         if (dst_len < ctx->key_size - 1)
 280                 return -EINVAL;
 281
 282         if (dst_len == ctx->key_size) {
 283                 if (out_buf[0] != 0x00)
 284                         /* Encrypted value had no leading 0 byte */
 285                         return -EINVAL;
 286
 287                 dst_len--;
 288                 out_buf++;
 289         }
 290
 291         if (out_buf[0] != 0x01)
 292                 return -EBADMSG;
 293
 294         for (pos = 1; pos < dst_len; pos++)
 295                 if (out_buf[pos] != 0xff)
 296                         break;
 297
 298         if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)
 299                 return -EBADMSG;
 300         pos++;
 301
 302         if (hash_prefix->size > dst_len - pos)
 303                 return -EBADMSG;
 304         if (crypto_memneq(out_buf + pos, hash_prefix->data, hash_prefix->size))
 305                 return -EBADMSG;
 306         pos += hash_prefix->size;
 307
 308         /* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */
 309         if (dlen != dst_len - pos)
 310                 return -EKEYREJECTED;
 311         if (memcmp(digest, out_buf + pos, dlen) != 0)
 312                 return -EKEYREJECTED;
 313
 314         return 0;
 315 }
 316
 317 static unsigned int rsassa_pkcs1_key_size(struct crypto_sig *tfm)
 318 {
 319         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 320
 321         return ctx->key_size;
 322 }
 323
 324 static int rsassa_pkcs1_set_pub_key(struct crypto_sig *tfm,
 325                                     const void *key, unsigned int keylen)
 326 {
 327         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 328
 329         return rsa_set_key(ctx->child, &ctx->key_size, RSA_PUB, key, keylen);
 330 }
 331
 332 static int rsassa_pkcs1_set_priv_key(struct crypto_sig *tfm,
 333                                      const void *key, unsigned int keylen)
 334 {
 335         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 336
 337         return rsa_set_key(ctx->child, &ctx->key_size, RSA_PRIV, key, keylen);
 338 }
 339
 340 static int rsassa_pkcs1_init_tfm(struct crypto_sig *tfm)
 341 {
 342         struct sig_instance *inst = sig_alg_instance(tfm);
 343         struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
 344         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 345         struct crypto_akcipher *child_tfm;
 346
 347         child_tfm = crypto_spawn_akcipher(&ictx->spawn);
 348         if (IS_ERR(child_tfm))
 349                 return PTR_ERR(child_tfm);
 350
 351         ctx->child = child_tfm;
 352
 353         return 0;
 354 }
 355
 356 static void rsassa_pkcs1_exit_tfm(struct crypto_sig *tfm)
 357 {
 358         struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
 359
 360         crypto_free_akcipher(ctx->child);
 361 }
 362
 363 static void rsassa_pkcs1_free(struct sig_instance *inst)
 364 {
 365         struct rsassa_pkcs1_inst_ctx *ctx = sig_instance_ctx(inst);
 366         struct crypto_akcipher_spawn *spawn = &ctx->spawn;
 367
 368         crypto_drop_akcipher(spawn);
 369         kfree(inst);
 370 }
 371
 372 static int rsassa_pkcs1_create(struct crypto_template *tmpl, struct rtattr **tb)
 373 {
 374         struct rsassa_pkcs1_inst_ctx *ctx;
 375         struct akcipher_alg *rsa_alg;
 376         struct sig_instance *inst;
 377         const char *hash_name;
 378         u32 mask;
 379         int err;
 380
 381         err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SIG, &mask);
 382         if (err)
 383                 return err;
 384
 385         inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
 386         if (!inst)
 387                 return -ENOMEM;
 388
 389         ctx = sig_instance_ctx(inst);
 390
 391         err = crypto_grab_akcipher(&ctx->spawn, sig_crypto_instance(inst),
 392                                    crypto_attr_alg_name(tb[1]), 0, mask);
 393         if (err)
 394                 goto err_free_inst;
 395
 396         rsa_alg = crypto_spawn_akcipher_alg(&ctx->spawn);
 397
 398         if (strcmp(rsa_alg->base.cra_name, "rsa") != 0) {
 399                 err = -EINVAL;
 400                 goto err_free_inst;
 401         }
 402
 403         hash_name = crypto_attr_alg_name(tb[2]);
 404         if (IS_ERR(hash_name)) {
 405                 err = PTR_ERR(hash_name);
 406                 goto err_free_inst;
 407         }
 408
 409         ctx->hash_prefix = rsassa_pkcs1_find_hash_prefix(hash_name);
 410         if (!ctx->hash_prefix) {
 411                 err = -EINVAL;
 412                 goto err_free_inst;
 413         }
 414
 415         err = -ENAMETOOLONG;
 416         if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
 417                      "pkcs1(%s,%s)", rsa_alg->base.cra_name,
 418                      hash_name) >= CRYPTO_MAX_ALG_NAME)
 419                 goto err_free_inst;
 420
 421         if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
 422                      "pkcs1(%s,%s)", rsa_alg->base.cra_driver_name,
 423                      hash_name) >= CRYPTO_MAX_ALG_NAME)
 424                 goto err_free_inst;
 425
 426         inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
 427         inst->alg.base.cra_ctxsize = sizeof(struct rsassa_pkcs1_ctx);
 428
 429         inst->alg.init = rsassa_pkcs1_init_tfm;
 430         inst->alg.exit = rsassa_pkcs1_exit_tfm;
 431
 432         inst->alg.sign = rsassa_pkcs1_sign;
 433         inst->alg.verify = rsassa_pkcs1_verify;
 434         inst->alg.key_size = rsassa_pkcs1_key_size;
 435         inst->alg.set_pub_key = rsassa_pkcs1_set_pub_key;
 436         inst->alg.set_priv_key = rsassa_pkcs1_set_priv_key;
 437
 438         inst->free = rsassa_pkcs1_free;
 439
 440         err = sig_register_instance(tmpl, inst);
 441         if (err) {
 442 err_free_inst:
 443                 rsassa_pkcs1_free(inst);
 444         }
 445         return err;
 446 }
 447
 448 struct crypto_template rsassa_pkcs1_tmpl = {
 449         .name = "pkcs1",
 450         .create = rsassa_pkcs1_create,
 451         .module = THIS_MODULE,
 452 };
 453
 454 MODULE_ALIAS_CRYPTO("pkcs1");