1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3 *
4 * LibTomCrypt is a library that provides various cryptographic
5 * algorithms in a highly modular and flexible manner.
6 *
7 * The library is free for all purposes without any express
8 * guarantee it works.
9 */
10 #include "tomcrypt_private.h"
11
12 /**
13 @file pkcs_1_pss_decode.c
14 PKCS #1 PSS Signature Padding, Tom St Denis
15 */
16
17 #ifdef LTC_PKCS_1
18
19 /**
20 PKCS #1 v2.00 PSS decode
21 @param msghash The hash to verify
22 @param msghashlen The length of the hash (octets)
23 @param sig The signature data (encoded data)
24 @param siglen The length of the signature data (octets)
25 @param saltlen The length of the salt used (octets)
26 @param hash_idx The index of the hash desired
27 @param modulus_bitlen The bit length of the RSA modulus
28 @param res [out] The result of the comparison, 1==valid, 0==invalid
29 @return CRYPT_OK if successful (even if the comparison failed)
30 */
pkcs_1_pss_decode(const unsigned char * msghash,unsigned long msghashlen,const unsigned char * sig,unsigned long siglen,unsigned long saltlen,int hash_idx,unsigned long modulus_bitlen,int * res)31 int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
32 const unsigned char *sig, unsigned long siglen,
33 unsigned long saltlen, int hash_idx,
34 unsigned long modulus_bitlen, int *res)
35 {
36 unsigned char *DB, *mask, *salt, *hash;
37 unsigned long x, y, hLen, modulus_len;
38 int err;
39 hash_state md;
40
41 LTC_ARGCHK(msghash != NULL);
42 LTC_ARGCHK(res != NULL);
43
44 /* default to invalid */
45 *res = 0;
46
47 /* ensure hash is valid */
48 if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
49 return err;
50 }
51
52 hLen = hash_descriptor[hash_idx]->hashsize;
53 modulus_bitlen--;
54 modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
55
56 /* check sizes */
57 if ((saltlen > modulus_len) ||
58 (modulus_len < hLen + saltlen + 2)) {
59 return CRYPT_PK_INVALID_SIZE;
60 }
61
62 /* allocate ram for DB/mask/salt/hash of size modulus_len */
63 DB = XMALLOC(modulus_len);
64 mask = XMALLOC(modulus_len);
65 salt = XMALLOC(modulus_len);
66 hash = XMALLOC(modulus_len);
67 if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
68 if (DB != NULL) {
69 XFREE(DB);
70 }
71 if (mask != NULL) {
72 XFREE(mask);
73 }
74 if (salt != NULL) {
75 XFREE(salt);
76 }
77 if (hash != NULL) {
78 XFREE(hash);
79 }
80 return CRYPT_MEM;
81 }
82
83 /* ensure the 0xBC byte */
84 if (sig[siglen-1] != 0xBC) {
85 err = CRYPT_INVALID_PACKET;
86 goto LBL_ERR;
87 }
88
89 /* copy out the DB */
90 x = 0;
91 XMEMCPY(DB, sig + x, modulus_len - hLen - 1);
92 x += modulus_len - hLen - 1;
93
94 /* copy out the hash */
95 XMEMCPY(hash, sig + x, hLen);
96 /* x += hLen; */
97
98 /* check the MSB */
99 if ((sig[0] & ~(0xFF >> ((modulus_len<<3) - (modulus_bitlen)))) != 0) {
100 err = CRYPT_INVALID_PACKET;
101 goto LBL_ERR;
102 }
103
104 /* generate mask of length modulus_len - hLen - 1 from hash */
105 if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
106 goto LBL_ERR;
107 }
108
109 /* xor against DB */
110 for (y = 0; y < (modulus_len - hLen - 1); y++) {
111 DB[y] ^= mask[y];
112 }
113
114 /* now clear the first byte [make sure smaller than modulus] */
115 DB[0] &= 0xFF >> ((modulus_len<<3) - (modulus_bitlen));
116
117 /* DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
118
119 /* check for zeroes and 0x01 */
120 for (x = 0; x < modulus_len - saltlen - hLen - 2; x++) {
121 if (DB[x] != 0x00) {
122 err = CRYPT_INVALID_PACKET;
123 goto LBL_ERR;
124 }
125 }
126
127 /* check for the 0x01 */
128 if (DB[x++] != 0x01) {
129 err = CRYPT_INVALID_PACKET;
130 goto LBL_ERR;
131 }
132
133 /* M = (eight) 0x00 || msghash || salt, mask = H(M) */
134 if ((err = hash_descriptor[hash_idx]->init(&md)) != CRYPT_OK) {
135 goto LBL_ERR;
136 }
137 zeromem(mask, 8);
138 if ((err = hash_descriptor[hash_idx]->process(&md, mask, 8)) != CRYPT_OK) {
139 goto LBL_ERR;
140 }
141 if ((err = hash_descriptor[hash_idx]->process(&md, msghash, msghashlen)) != CRYPT_OK) {
142 goto LBL_ERR;
143 }
144 if ((err = hash_descriptor[hash_idx]->process(&md, DB+x, saltlen)) != CRYPT_OK) {
145 goto LBL_ERR;
146 }
147 if ((err = hash_descriptor[hash_idx]->done(&md, mask)) != CRYPT_OK) {
148 goto LBL_ERR;
149 }
150
151 /* mask == hash means valid signature */
152 if (XMEM_NEQ(mask, hash, hLen) == 0) {
153 *res = 1;
154 }
155
156 err = CRYPT_OK;
157 LBL_ERR:
158 #ifdef LTC_CLEAN_STACK
159 zeromem(DB, modulus_len);
160 zeromem(mask, modulus_len);
161 zeromem(salt, modulus_len);
162 zeromem(hash, modulus_len);
163 #endif
164
165 XFREE(hash);
166 XFREE(salt);
167 XFREE(mask);
168 XFREE(DB);
169
170 return err;
171 }
172
173 #endif /* LTC_PKCS_1 */
174
175 /* ref: $Format:%D$ */
176 /* git commit: $Format:%H$ */
177 /* commit time: $Format:%ai$ */
178