1 /*
2 * SPDX-License-Identifier: Apache-2.0
3 *
4 * Copyright (c) 2017-2018 Linaro LTD
5 * Copyright (c) 2017-2019 JUUL Labs
6 * Copyright (c) 2020 Arm Limited
7 *
8 * Original license:
9 *
10 * Licensed to the Apache Software Foundation (ASF) under one
11 * or more contributor license agreements. See the NOTICE file
12 * distributed with this work for additional information
13 * regarding copyright ownership. The ASF licenses this file
14 * to you under the Apache License, Version 2.0 (the
15 * "License"); you may not use this file except in compliance
16 * with the License. You may obtain a copy of the License at
17 *
18 * http://www.apache.org/licenses/LICENSE-2.0
19 *
20 * Unless required by applicable law or agreed to in writing,
21 * software distributed under the License is distributed on an
22 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23 * KIND, either express or implied. See the License for the
24 * specific language governing permissions and limitations
25 * under the License.
26 */
27
28 #include <string.h>
29
30 #include "mcuboot_config/mcuboot_config.h"
31
32 #ifdef MCUBOOT_SIGN_RSA
33 #include "bootutil/sign_key.h"
34 #include "bootutil/crypto/sha256.h"
35
36 #include "mbedtls/rsa.h"
37 #include "mbedtls/asn1.h"
38 #include "mbedtls/version.h"
39
40 #include "bootutil_priv.h"
41 #include "bootutil/fault_injection_hardening.h"
42
43 /*
44 * Constants for this particular constrained implementation of
45 * RSA-PSS. In particular, we support RSA 2048, with a SHA256 hash,
46 * and a 32-byte salt. A signature with different parameters will be
47 * rejected as invalid.
48 */
49
50 /* The size, in octets, of the message. */
51 #define PSS_EMLEN (MCUBOOT_SIGN_RSA_LEN / 8)
52
53 /* The size of the hash function. For SHA256, this is 32 bytes. */
54 #define PSS_HLEN 32
55
56 /* Size of the salt, should be fixed. */
57 #define PSS_SLEN 32
58
59 /* The length of the mask: emLen - hLen - 1. */
60 #define PSS_MASK_LEN (PSS_EMLEN - PSS_HLEN - 1)
61
62 #define PSS_HASH_OFFSET PSS_MASK_LEN
63
64 /* For the mask itself, how many bytes should be all zeros. */
65 #define PSS_MASK_ZERO_COUNT (PSS_MASK_LEN - PSS_SLEN - 1)
66 #define PSS_MASK_ONE_POS PSS_MASK_ZERO_COUNT
67
68 /* Where the salt starts. */
69 #define PSS_MASK_SALT_POS (PSS_MASK_ONE_POS + 1)
70
71 static const uint8_t pss_zeros[8] = {0};
72
73 /*
74 * Parse the public key used for signing. Simple RSA format.
75 */
76 static int
bootutil_parse_rsakey(mbedtls_rsa_context * ctx,uint8_t ** p,uint8_t * end)77 bootutil_parse_rsakey(mbedtls_rsa_context *ctx, uint8_t **p, uint8_t *end)
78 {
79 int rc;
80 size_t len;
81
82 if ((rc = mbedtls_asn1_get_tag(p, end, &len,
83 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
84 return -1;
85 }
86
87 if (*p + len != end) {
88 return -2;
89 }
90
91 if ((rc = mbedtls_asn1_get_mpi(p, end, &ctx->N)) != 0 ||
92 (rc = mbedtls_asn1_get_mpi(p, end, &ctx->E)) != 0) {
93 return -3;
94 }
95
96 ctx->len = mbedtls_mpi_size(&ctx->N);
97
98 if (*p != end) {
99 return -4;
100 }
101
102 /* The mbedtls version is more than 2.6.1 */
103 #if MBEDTLS_VERSION_NUMBER > 0x02060100
104 rc = mbedtls_rsa_import(ctx, &ctx->N, NULL, NULL, NULL, &ctx->E);
105 if (rc != 0) {
106 return -5;
107 }
108 #endif
109
110 rc = mbedtls_rsa_check_pubkey(ctx);
111 if (rc != 0) {
112 return -6;
113 }
114
115 ctx->len = mbedtls_mpi_size(&ctx->N);
116
117 return 0;
118 }
119
120 /*
121 * Compute the RSA-PSS mask-generation function, MGF1. Assumptions
122 * are that the mask length will be less than 256 * PSS_HLEN, and
123 * therefore we never need to increment anything other than the low
124 * byte of the counter.
125 *
126 * This is described in PKCS#1, B.2.1.
127 */
128 static void
pss_mgf1(uint8_t * mask,const uint8_t * hash)129 pss_mgf1(uint8_t *mask, const uint8_t *hash)
130 {
131 bootutil_sha256_context ctx;
132 uint8_t counter[4] = { 0, 0, 0, 0 };
133 uint8_t htmp[PSS_HLEN];
134 int count = PSS_MASK_LEN;
135 int bytes;
136
137 while (count > 0) {
138 bootutil_sha256_init(&ctx);
139 bootutil_sha256_update(&ctx, hash, PSS_HLEN);
140 bootutil_sha256_update(&ctx, counter, 4);
141 bootutil_sha256_finish(&ctx, htmp);
142
143 counter[3]++;
144
145 bytes = PSS_HLEN;
146 if (bytes > count)
147 bytes = count;
148
149 memcpy(mask, htmp, bytes);
150 mask += bytes;
151 count -= bytes;
152 }
153
154 bootutil_sha256_drop(&ctx);
155 }
156
157 /*
158 * Validate an RSA signature, using RSA-PSS, as described in PKCS #1
159 * v2.2, section 9.1.2, with many parameters required to have fixed
160 * values.
161 */
162 static fih_int
bootutil_cmp_rsasig(mbedtls_rsa_context * ctx,uint8_t * hash,uint32_t hlen,uint8_t * sig)163 bootutil_cmp_rsasig(mbedtls_rsa_context *ctx, uint8_t *hash, uint32_t hlen,
164 uint8_t *sig)
165 {
166 bootutil_sha256_context shactx;
167 uint8_t em[MBEDTLS_MPI_MAX_SIZE];
168 uint8_t db_mask[PSS_MASK_LEN];
169 uint8_t h2[PSS_HLEN];
170 int i;
171 int rc = 0;
172 fih_int fih_rc = FIH_FAILURE;
173
174 if (ctx->len != PSS_EMLEN || PSS_EMLEN > MBEDTLS_MPI_MAX_SIZE) {
175 rc = -1;
176 goto out;
177 }
178
179 if (hlen != PSS_HLEN) {
180 rc = -1;
181 goto out;
182 }
183
184 if (mbedtls_rsa_public(ctx, sig, em)) {
185 rc = -1;
186 goto out;
187 }
188
189 /*
190 * PKCS #1 v2.2, 9.1.2 EMSA-PSS-Verify
191 *
192 * emBits is 2048
193 * emLen = ceil(emBits/8) = 256
194 *
195 * The salt length is not known at the beginning.
196 */
197
198 /* Step 1. The message is constrained by the address space of a
199 * 32-bit processor, which is far less than the 2^61-1 limit of
200 * SHA-256.
201 */
202
203 /* Step 2. mHash is passed in as 'hash', with hLen the hlen
204 * argument. */
205
206 /* Step 3. if emLen < hLen + sLen + 2, inconsistent and stop.
207 * The salt length is not known at this point.
208 */
209
210 /* Step 4. If the rightmost octet of EM does have the value
211 * 0xbc, output inconsistent and stop.
212 */
213 if (em[PSS_EMLEN - 1] != 0xbc) {
214 rc = -1;
215 goto out;
216 }
217
218 /* Step 5. Let maskedDB be the leftmost emLen - hLen - 1 octets
219 * of EM, and H be the next hLen octets.
220 *
221 * maskedDB is then the first 256 - 32 - 1 = 0-222
222 * H is 32 bytes 223-254
223 */
224
225 /* Step 6. If the leftmost 8emLen - emBits bits of the leftmost
226 * octet in maskedDB are not all equal to zero, output
227 * inconsistent and stop.
228 *
229 * 8emLen - emBits is zero, so there is nothing to test here.
230 */
231
232 /* Step 7. let dbMask = MGF(H, emLen - hLen - 1). */
233 pss_mgf1(db_mask, &em[PSS_HASH_OFFSET]);
234
235 /* Step 8. let DB = maskedDB xor dbMask.
236 * To avoid needing an additional buffer, store the 'db' in the
237 * same buffer as db_mask. From now, to the end of this function,
238 * db_mask refers to the unmasked 'db'. */
239 for (i = 0; i < PSS_MASK_LEN; i++) {
240 db_mask[i] ^= em[i];
241 }
242
243 /* Step 9. Set the leftmost 8emLen - emBits bits of the leftmost
244 * octet in DB to zero.
245 * pycrypto seems to always make the emBits 2047, so we need to
246 * clear the top bit. */
247 db_mask[0] &= 0x7F;
248
249 /* Step 10. If the emLen - hLen - sLen - 2 leftmost octets of DB
250 * are not zero or if the octet at position emLen - hLen - sLen -
251 * 1 (the leftmost position is "position 1") does not have
252 * hexadecimal value 0x01, output "inconsistent" and stop. */
253 for (i = 0; i < PSS_MASK_ZERO_COUNT; i++) {
254 if (db_mask[i] != 0) {
255 rc = -1;
256 goto out;
257 }
258 }
259
260 if (db_mask[PSS_MASK_ONE_POS] != 1) {
261 rc = -1;
262 goto out;
263 }
264
265 /* Step 11. Let salt be the last sLen octets of DB */
266
267 /* Step 12. Let M' = 0x00 00 00 00 00 00 00 00 || mHash || salt; */
268
269 /* Step 13. Let H' = Hash(M') */
270 bootutil_sha256_init(&shactx);
271 bootutil_sha256_update(&shactx, pss_zeros, 8);
272 bootutil_sha256_update(&shactx, hash, PSS_HLEN);
273 bootutil_sha256_update(&shactx, &db_mask[PSS_MASK_SALT_POS], PSS_SLEN);
274 bootutil_sha256_finish(&shactx, h2);
275 bootutil_sha256_drop(&shactx);
276
277 /* Step 14. If H = H', output "consistent". Otherwise, output
278 * "inconsistent". */
279 FIH_CALL(boot_fih_memequal, fih_rc, h2, &em[PSS_HASH_OFFSET], PSS_HLEN);
280
281 out:
282 if (rc) {
283 fih_rc = fih_int_encode(rc);
284 }
285
286 FIH_RET(fih_rc);
287 }
288
289 fih_int
bootutil_verify_sig(uint8_t * hash,uint32_t hlen,uint8_t * sig,size_t slen,uint8_t key_id)290 bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
291 uint8_t key_id)
292 {
293 mbedtls_rsa_context ctx;
294 int rc;
295 fih_int fih_rc = FIH_FAILURE;
296 uint8_t *cp;
297 uint8_t *end;
298
299 mbedtls_rsa_init(&ctx, 0, 0);
300
301 cp = (uint8_t *)bootutil_keys[key_id].key;
302 end = cp + *bootutil_keys[key_id].len;
303
304 rc = bootutil_parse_rsakey(&ctx, &cp, end);
305 if (rc || slen != ctx.len) {
306 mbedtls_rsa_free(&ctx);
307 goto out;
308 }
309 FIH_CALL(bootutil_cmp_rsasig, fih_rc, &ctx, hash, hlen, sig);
310
311 out:
312 mbedtls_rsa_free(&ctx);
313
314 FIH_RET(fih_rc);
315 }
316 #endif /* MCUBOOT_SIGN_RSA */
317
