1 /*
2 * PSA RSA layer on top of Mbed TLS crypto
3 */
4 /*
5 * Copyright The Mbed TLS Contributors
6 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
19 */
20
21 #include "common.h"
22
23 #if defined(MBEDTLS_PSA_CRYPTO_C)
24
25 #include <psa/crypto.h>
26 #include "psa_crypto_core.h"
27 #include "psa_crypto_random_impl.h"
28 #include "psa_crypto_rsa.h"
29 #include "psa_crypto_hash.h"
30
31 #include <stdlib.h>
32 #include <string.h>
33 #include "mbedtls/platform.h"
34 #if !defined(MBEDTLS_PLATFORM_C)
35 #define mbedtls_calloc calloc
36 #define mbedtls_free free
37 #endif
38
39 #include <mbedtls/rsa.h>
40 #include <mbedtls/error.h>
41 #include <mbedtls/pk.h>
42 #include <mbedtls/pk_internal.h>
43
44 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
45 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
46 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
47 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
48 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
49 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
50
51 /* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
52 * that are not a multiple of 8) well. For example, there is only
53 * mbedtls_rsa_get_len(), which returns a number of bytes, and no
54 * way to return the exact bit size of a key.
55 * To keep things simple, reject non-byte-aligned key sizes. */
psa_check_rsa_key_byte_aligned(const mbedtls_rsa_context * rsa)56 static psa_status_t psa_check_rsa_key_byte_aligned(
57 const mbedtls_rsa_context *rsa )
58 {
59 mbedtls_mpi n;
60 psa_status_t status;
61 mbedtls_mpi_init( &n );
62 status = mbedtls_to_psa_error(
63 mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
64 if( status == PSA_SUCCESS )
65 {
66 if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
67 status = PSA_ERROR_NOT_SUPPORTED;
68 }
69 mbedtls_mpi_free( &n );
70 return( status );
71 }
72
mbedtls_psa_rsa_load_representation(psa_key_type_t type,const uint8_t * data,size_t data_length,mbedtls_rsa_context ** p_rsa)73 psa_status_t mbedtls_psa_rsa_load_representation(
74 psa_key_type_t type, const uint8_t *data, size_t data_length,
75 mbedtls_rsa_context **p_rsa )
76 {
77 psa_status_t status;
78 mbedtls_pk_context ctx;
79 size_t bits;
80 mbedtls_pk_init( &ctx );
81
82 /* Parse the data. */
83 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
84 status = mbedtls_to_psa_error(
85 mbedtls_pk_parse_key( &ctx, data, data_length, NULL, 0 ) );
86 else
87 status = mbedtls_to_psa_error(
88 mbedtls_pk_parse_public_key( &ctx, data, data_length ) );
89 if( status != PSA_SUCCESS )
90 goto exit;
91
92 /* We have something that the pkparse module recognizes. If it is a
93 * valid RSA key, store it. */
94 if( mbedtls_pk_get_type( &ctx ) != MBEDTLS_PK_RSA )
95 {
96 status = PSA_ERROR_INVALID_ARGUMENT;
97 goto exit;
98 }
99
100 /* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
101 * supports non-byte-aligned key sizes, but not well. For example,
102 * mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
103 bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( mbedtls_pk_rsa( ctx ) ) );
104 if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
105 {
106 status = PSA_ERROR_NOT_SUPPORTED;
107 goto exit;
108 }
109 status = psa_check_rsa_key_byte_aligned( mbedtls_pk_rsa( ctx ) );
110 if( status != PSA_SUCCESS )
111 goto exit;
112
113 /* Copy out the pointer to the RSA context, and reset the PK context
114 * such that pk_free doesn't free the RSA context we just grabbed. */
115 *p_rsa = mbedtls_pk_rsa( ctx );
116 ctx.pk_info = NULL;
117
118 exit:
119 mbedtls_pk_free( &ctx );
120 return( status );
121 }
122 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
123 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
124 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
125 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
126 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
127 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
128
129 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
130 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
131
mbedtls_psa_rsa_import_key(const psa_key_attributes_t * attributes,const uint8_t * data,size_t data_length,uint8_t * key_buffer,size_t key_buffer_size,size_t * key_buffer_length,size_t * bits)132 psa_status_t mbedtls_psa_rsa_import_key(
133 const psa_key_attributes_t *attributes,
134 const uint8_t *data, size_t data_length,
135 uint8_t *key_buffer, size_t key_buffer_size,
136 size_t *key_buffer_length, size_t *bits )
137 {
138 psa_status_t status;
139 mbedtls_rsa_context *rsa = NULL;
140
141 /* Parse input */
142 status = mbedtls_psa_rsa_load_representation( attributes->core.type,
143 data,
144 data_length,
145 &rsa );
146 if( status != PSA_SUCCESS )
147 goto exit;
148
149 *bits = (psa_key_bits_t) PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( rsa ) );
150
151 /* Re-export the data to PSA export format, such that we can store export
152 * representation in the key slot. Export representation in case of RSA is
153 * the smallest representation that's allowed as input, so a straight-up
154 * allocation of the same size as the input buffer will be large enough. */
155 status = mbedtls_psa_rsa_export_key( attributes->core.type,
156 rsa,
157 key_buffer,
158 key_buffer_size,
159 key_buffer_length );
160 exit:
161 /* Always free the RSA object */
162 mbedtls_rsa_free( rsa );
163 mbedtls_free( rsa );
164
165 return( status );
166 }
167
mbedtls_psa_rsa_export_key(psa_key_type_t type,mbedtls_rsa_context * rsa,uint8_t * data,size_t data_size,size_t * data_length)168 psa_status_t mbedtls_psa_rsa_export_key( psa_key_type_t type,
169 mbedtls_rsa_context *rsa,
170 uint8_t *data,
171 size_t data_size,
172 size_t *data_length )
173 {
174 #if defined(MBEDTLS_PK_WRITE_C)
175 int ret;
176 mbedtls_pk_context pk;
177 uint8_t *pos = data + data_size;
178
179 mbedtls_pk_init( &pk );
180 pk.pk_info = &mbedtls_rsa_info;
181 pk.pk_ctx = rsa;
182
183 /* PSA Crypto API defines the format of an RSA key as a DER-encoded
184 * representation of the non-encrypted PKCS#1 RSAPrivateKey for a
185 * private key and of the RFC3279 RSAPublicKey for a public key. */
186 if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
187 ret = mbedtls_pk_write_key_der( &pk, data, data_size );
188 else
189 ret = mbedtls_pk_write_pubkey( &pos, data, &pk );
190
191 if( ret < 0 )
192 {
193 /* Clean up in case pk_write failed halfway through. */
194 memset( data, 0, data_size );
195 return( mbedtls_to_psa_error( ret ) );
196 }
197
198 /* The mbedtls_pk_xxx functions write to the end of the buffer.
199 * Move the data to the beginning and erase remaining data
200 * at the original location. */
201 if( 2 * (size_t) ret <= data_size )
202 {
203 memcpy( data, data + data_size - ret, ret );
204 memset( data + data_size - ret, 0, ret );
205 }
206 else if( (size_t) ret < data_size )
207 {
208 memmove( data, data + data_size - ret, ret );
209 memset( data + ret, 0, data_size - ret );
210 }
211
212 *data_length = ret;
213 return( PSA_SUCCESS );
214 #else
215 (void) type;
216 (void) rsa;
217 (void) data;
218 (void) data_size;
219 (void) data_length;
220 return( PSA_ERROR_NOT_SUPPORTED );
221 #endif /* MBEDTLS_PK_WRITE_C */
222 }
223
mbedtls_psa_rsa_export_public_key(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,uint8_t * data,size_t data_size,size_t * data_length)224 psa_status_t mbedtls_psa_rsa_export_public_key(
225 const psa_key_attributes_t *attributes,
226 const uint8_t *key_buffer, size_t key_buffer_size,
227 uint8_t *data, size_t data_size, size_t *data_length )
228 {
229 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
230 mbedtls_rsa_context *rsa = NULL;
231
232 status = mbedtls_psa_rsa_load_representation(
233 attributes->core.type, key_buffer, key_buffer_size, &rsa );
234 if( status != PSA_SUCCESS )
235 return( status );
236
237 status = mbedtls_psa_rsa_export_key( PSA_KEY_TYPE_RSA_PUBLIC_KEY,
238 rsa,
239 data,
240 data_size,
241 data_length );
242
243 mbedtls_rsa_free( rsa );
244 mbedtls_free( rsa );
245
246 return( status );
247 }
248 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
249 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
250
251 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \
252 defined(MBEDTLS_GENPRIME)
psa_rsa_read_exponent(const uint8_t * domain_parameters,size_t domain_parameters_size,int * exponent)253 static psa_status_t psa_rsa_read_exponent( const uint8_t *domain_parameters,
254 size_t domain_parameters_size,
255 int *exponent )
256 {
257 size_t i;
258 uint32_t acc = 0;
259
260 if( domain_parameters_size == 0 )
261 {
262 *exponent = 65537;
263 return( PSA_SUCCESS );
264 }
265
266 /* Mbed TLS encodes the public exponent as an int. For simplicity, only
267 * support values that fit in a 32-bit integer, which is larger than
268 * int on just about every platform anyway. */
269 if( domain_parameters_size > sizeof( acc ) )
270 return( PSA_ERROR_NOT_SUPPORTED );
271 for( i = 0; i < domain_parameters_size; i++ )
272 acc = ( acc << 8 ) | domain_parameters[i];
273 if( acc > INT_MAX )
274 return( PSA_ERROR_NOT_SUPPORTED );
275 *exponent = acc;
276 return( PSA_SUCCESS );
277 }
278
mbedtls_psa_rsa_generate_key(const psa_key_attributes_t * attributes,uint8_t * key_buffer,size_t key_buffer_size,size_t * key_buffer_length)279 psa_status_t mbedtls_psa_rsa_generate_key(
280 const psa_key_attributes_t *attributes,
281 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
282 {
283 psa_status_t status;
284 mbedtls_rsa_context rsa;
285 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
286 int exponent;
287
288 status = psa_rsa_read_exponent( attributes->domain_parameters,
289 attributes->domain_parameters_size,
290 &exponent );
291 if( status != PSA_SUCCESS )
292 return( status );
293
294 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
295 ret = mbedtls_rsa_gen_key( &rsa,
296 mbedtls_psa_get_random,
297 MBEDTLS_PSA_RANDOM_STATE,
298 (unsigned int)attributes->core.bits,
299 exponent );
300 if( ret != 0 )
301 return( mbedtls_to_psa_error( ret ) );
302
303 status = mbedtls_psa_rsa_export_key( attributes->core.type,
304 &rsa, key_buffer, key_buffer_size,
305 key_buffer_length );
306 mbedtls_rsa_free( &rsa );
307
308 return( status );
309 }
310 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
311 * defined(MBEDTLS_GENPRIME) */
312
313 /****************************************************************/
314 /* Sign/verify hashes */
315 /****************************************************************/
316
317 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
318 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
319
320 /* Decode the hash algorithm from alg and store the mbedtls encoding in
321 * md_alg. Verify that the hash length is acceptable. */
psa_rsa_decode_md_type(psa_algorithm_t alg,size_t hash_length,mbedtls_md_type_t * md_alg)322 static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
323 size_t hash_length,
324 mbedtls_md_type_t *md_alg )
325 {
326 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
327 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
328 *md_alg = mbedtls_md_get_type( md_info );
329
330 /* The Mbed TLS RSA module uses an unsigned int for hash length
331 * parameters. Validate that it fits so that we don't risk an
332 * overflow later. */
333 #if SIZE_MAX > UINT_MAX
334 if( hash_length > UINT_MAX )
335 return( PSA_ERROR_INVALID_ARGUMENT );
336 #endif
337
338 /* For signatures using a hash, the hash length must be correct. */
339 if( alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
340 {
341 if( md_info == NULL )
342 return( PSA_ERROR_NOT_SUPPORTED );
343 if( mbedtls_md_get_size( md_info ) != hash_length )
344 return( PSA_ERROR_INVALID_ARGUMENT );
345 }
346
347 return( PSA_SUCCESS );
348 }
349
mbedtls_psa_rsa_sign_hash(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,uint8_t * signature,size_t signature_size,size_t * signature_length)350 psa_status_t mbedtls_psa_rsa_sign_hash(
351 const psa_key_attributes_t *attributes,
352 const uint8_t *key_buffer, size_t key_buffer_size,
353 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
354 uint8_t *signature, size_t signature_size, size_t *signature_length )
355 {
356 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
357 mbedtls_rsa_context *rsa = NULL;
358 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
359 mbedtls_md_type_t md_alg;
360
361 status = mbedtls_psa_rsa_load_representation( attributes->core.type,
362 key_buffer,
363 key_buffer_size,
364 &rsa );
365 if( status != PSA_SUCCESS )
366 return( status );
367
368 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
369 if( status != PSA_SUCCESS )
370 goto exit;
371
372 if( signature_size < mbedtls_rsa_get_len( rsa ) )
373 {
374 status = PSA_ERROR_BUFFER_TOO_SMALL;
375 goto exit;
376 }
377
378 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
379 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
380 {
381 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
382 MBEDTLS_MD_NONE );
383 ret = mbedtls_rsa_pkcs1_sign( rsa,
384 mbedtls_psa_get_random,
385 MBEDTLS_PSA_RANDOM_STATE,
386 MBEDTLS_RSA_PRIVATE,
387 md_alg,
388 (unsigned int) hash_length,
389 hash,
390 signature );
391 }
392 else
393 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
394 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
395 if( PSA_ALG_IS_RSA_PSS( alg ) )
396 {
397 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
398 ret = mbedtls_rsa_rsassa_pss_sign( rsa,
399 mbedtls_psa_get_random,
400 MBEDTLS_PSA_RANDOM_STATE,
401 MBEDTLS_RSA_PRIVATE,
402 MBEDTLS_MD_NONE,
403 (unsigned int) hash_length,
404 hash,
405 signature );
406 }
407 else
408 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
409 {
410 status = PSA_ERROR_INVALID_ARGUMENT;
411 goto exit;
412 }
413
414 if( ret == 0 )
415 *signature_length = mbedtls_rsa_get_len( rsa );
416 status = mbedtls_to_psa_error( ret );
417
418 exit:
419 mbedtls_rsa_free( rsa );
420 mbedtls_free( rsa );
421
422 return( status );
423 }
424
425 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
rsa_pss_expected_salt_len(psa_algorithm_t alg,const mbedtls_rsa_context * rsa,size_t hash_length)426 static int rsa_pss_expected_salt_len( psa_algorithm_t alg,
427 const mbedtls_rsa_context *rsa,
428 size_t hash_length )
429 {
430 if( PSA_ALG_IS_RSA_PSS_ANY_SALT( alg ) )
431 return( MBEDTLS_RSA_SALT_LEN_ANY );
432 /* Otherwise: standard salt length, i.e. largest possible salt length
433 * up to the hash length. */
434 int klen = (int) mbedtls_rsa_get_len( rsa ); // known to fit
435 int hlen = (int) hash_length; // known to fit
436 int room = klen - 2 - hlen;
437 if( room < 0 )
438 return( 0 ); // there is no valid signature in this case anyway
439 else if( room > hlen )
440 return( hlen );
441 else
442 return( room );
443 }
444 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
445
mbedtls_psa_rsa_verify_hash(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,const uint8_t * signature,size_t signature_length)446 psa_status_t mbedtls_psa_rsa_verify_hash(
447 const psa_key_attributes_t *attributes,
448 const uint8_t *key_buffer, size_t key_buffer_size,
449 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
450 const uint8_t *signature, size_t signature_length )
451 {
452 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
453 mbedtls_rsa_context *rsa = NULL;
454 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
455 mbedtls_md_type_t md_alg;
456
457 status = mbedtls_psa_rsa_load_representation( attributes->core.type,
458 key_buffer,
459 key_buffer_size,
460 &rsa );
461 if( status != PSA_SUCCESS )
462 goto exit;
463
464 status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
465 if( status != PSA_SUCCESS )
466 goto exit;
467
468 if( signature_length != mbedtls_rsa_get_len( rsa ) )
469 {
470 status = PSA_ERROR_INVALID_SIGNATURE;
471 goto exit;
472 }
473
474 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
475 if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
476 {
477 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
478 MBEDTLS_MD_NONE );
479 ret = mbedtls_rsa_pkcs1_verify( rsa,
480 mbedtls_psa_get_random,
481 MBEDTLS_PSA_RANDOM_STATE,
482 MBEDTLS_RSA_PUBLIC,
483 md_alg,
484 (unsigned int) hash_length,
485 hash,
486 signature );
487 }
488 else
489 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
490 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
491 if( PSA_ALG_IS_RSA_PSS( alg ) )
492 {
493 int slen = rsa_pss_expected_salt_len( alg, rsa, hash_length );
494 mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
495 ret = mbedtls_rsa_rsassa_pss_verify_ext( rsa,
496 mbedtls_psa_get_random,
497 MBEDTLS_PSA_RANDOM_STATE,
498 MBEDTLS_RSA_PUBLIC,
499 md_alg,
500 (unsigned int) hash_length,
501 hash,
502 md_alg,
503 slen,
504 signature );
505 }
506 else
507 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
508 {
509 status = PSA_ERROR_INVALID_ARGUMENT;
510 goto exit;
511 }
512
513 /* Mbed TLS distinguishes "invalid padding" from "valid padding but
514 * the rest of the signature is invalid". This has little use in
515 * practice and PSA doesn't report this distinction. */
516 status = ( ret == MBEDTLS_ERR_RSA_INVALID_PADDING ) ?
517 PSA_ERROR_INVALID_SIGNATURE :
518 mbedtls_to_psa_error( ret );
519
520 exit:
521 mbedtls_rsa_free( rsa );
522 mbedtls_free( rsa );
523
524 return( status );
525 }
526
527 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
528 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
529
530 #endif /* MBEDTLS_PSA_CRYPTO_C */
531
