1// Copyright 2015-2016 Brian Smith.
2//
3// Permission to use, copy, modify, and/or distribute this software for any
4// purpose with or without fee is hereby granted, provided that the above
5// copyright notice and this permission notice appear in all copies.
6//
7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14
15use crate::{bits, constant_time, digest, error, rand};
16
17mod pkcs1;
18mod pss;
19
20pub use self::{
21 pkcs1::{RSA_PKCS1_SHA256, RSA_PKCS1_SHA384, RSA_PKCS1_SHA512},
22 pss::{RSA_PSS_SHA256, RSA_PSS_SHA384, RSA_PSS_SHA512},
23};
24pub(super) use pkcs1::RSA_PKCS1_SHA1_FOR_LEGACY_USE_ONLY;
25
26/// Common features of both RSA padding encoding and RSA padding verification.
27pub trait Padding: 'static + Sync + crate::sealed::Sealed + core::fmt::Debug {
28 // The digest algorithm used for digesting the message (and maybe for
29 // other things).
30 fn digest_alg(&self) -> &'static digest::Algorithm;
31}
32
33/// An RSA signature encoding as described in [RFC 3447 Section 8].
34///
35/// [RFC 3447 Section 8]: https://tools.ietf.org/html/rfc3447#section-8
36#[cfg(feature = "alloc")]
37pub trait RsaEncoding: Padding {
38 #[doc(hidden)]
39 fn encode(
40 &self,
41 m_hash: digest::Digest,
42 m_out: &mut [u8],
43 mod_bits: bits::BitLength,
44 rng: &dyn rand::SecureRandom,
45 ) -> Result<(), error::Unspecified>;
46}
47
48/// Verification of an RSA signature encoding as described in
49/// [RFC 3447 Section 8].
50///
51/// [RFC 3447 Section 8]: https://tools.ietf.org/html/rfc3447#section-8
52pub trait Verification: Padding {
53 fn verify(
54 &self,
55 m_hash: digest::Digest,
56 m: &mut untrusted::Reader,
57 mod_bits: bits::BitLength,
58 ) -> Result<(), error::Unspecified>;
59}
60
61// Masks `out` with the output of the mask-generating function MGF1 as
62// described in https://tools.ietf.org/html/rfc3447#appendix-B.2.1.
63fn mgf1(digest_alg: &'static digest::Algorithm, seed: &[u8], out: &mut [u8]) {
64 let digest_len: usize = digest_alg.output_len();
65
66 // Maximum counter value is the value of (mask_len / digest_len) rounded up.
67 for (i: usize, out: &mut [u8]) in out.chunks_mut(chunk_size:digest_len).enumerate() {
68 let mut ctx: Context = digest::Context::new(algorithm:digest_alg);
69 ctx.update(data:seed);
70 // The counter will always fit in a `u32` because we reject absurdly
71 // long inputs very early.
72 ctx.update(&u32::to_be_bytes(self:i.try_into().unwrap()));
73 let digest: Digest = ctx.finish();
74
75 // The last chunk may legitimately be shorter than `digest`, but
76 // `digest` will never be shorter than `out`.
77 constant_time::xor_assign_at_start(a:out, b:digest.as_ref());
78 }
79}
80
81#[cfg(test)]
82mod test {
83 use super::*;
84 use crate::{digest, error, test};
85 use alloc::vec;
86
87 #[test]
88 fn test_pss_padding_verify() {
89 test::run(
90 test_file!("rsa_pss_padding_tests.txt"),
91 |section, test_case| {
92 assert_eq!(section, "");
93
94 let digest_name = test_case.consume_string("Digest");
95 let alg = match digest_name.as_ref() {
96 "SHA256" => &RSA_PSS_SHA256,
97 "SHA384" => &RSA_PSS_SHA384,
98 "SHA512" => &RSA_PSS_SHA512,
99 _ => panic!("Unsupported digest: {}", digest_name),
100 };
101
102 let msg = test_case.consume_bytes("Msg");
103 let msg = untrusted::Input::from(&msg);
104 let m_hash = digest::digest(alg.digest_alg(), msg.as_slice_less_safe());
105
106 let encoded = test_case.consume_bytes("EM");
107 let encoded = untrusted::Input::from(&encoded);
108
109 // Salt is recomputed in verification algorithm.
110 let _ = test_case.consume_bytes("Salt");
111
112 let bit_len = test_case.consume_usize_bits("Len");
113 let is_valid = test_case.consume_string("Result") == "P";
114
115 let actual_result =
116 encoded.read_all(error::Unspecified, |m| alg.verify(m_hash, m, bit_len));
117 assert_eq!(actual_result.is_ok(), is_valid);
118
119 Ok(())
120 },
121 );
122 }
123
124 // Tests PSS encoding for various public modulus lengths.
125 #[cfg(feature = "alloc")]
126 #[test]
127 fn test_pss_padding_encode() {
128 test::run(
129 test_file!("rsa_pss_padding_tests.txt"),
130 |section, test_case| {
131 assert_eq!(section, "");
132
133 let digest_name = test_case.consume_string("Digest");
134 let alg = match digest_name.as_ref() {
135 "SHA256" => &RSA_PSS_SHA256,
136 "SHA384" => &RSA_PSS_SHA384,
137 "SHA512" => &RSA_PSS_SHA512,
138 _ => panic!("Unsupported digest: {}", digest_name),
139 };
140
141 let msg = test_case.consume_bytes("Msg");
142 let salt = test_case.consume_bytes("Salt");
143 let encoded = test_case.consume_bytes("EM");
144 let bit_len = test_case.consume_usize_bits("Len");
145 let expected_result = test_case.consume_string("Result");
146
147 // Only test the valid outputs
148 if expected_result != "P" {
149 return Ok(());
150 }
151
152 let rng = test::rand::FixedSliceRandom { bytes: &salt };
153
154 let mut m_out = vec![0u8; bit_len.as_usize_bytes_rounded_up()];
155 let digest = digest::digest(alg.digest_alg(), &msg);
156 alg.encode(digest, &mut m_out, bit_len, &rng).unwrap();
157 assert_eq!(m_out, encoded);
158
159 Ok(())
160 },
161 );
162 }
163}
164