1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3  *
4  * LibTomCrypt is a library that provides various cryptographic
5  * algorithms in a highly modular and flexible manner.
6  *
7  * The library is free for all purposes without any express
8  * guarantee it works.
9  */
10 #include "tomcrypt_private.h"
11 
12 /**
13   @file pkcs_1_pss_encode.c
14   PKCS #1 PSS Signature Padding, Tom St Denis
15 */
16 
17 #ifdef LTC_PKCS_1
18 
19 /**
20    PKCS #1 v2.00 Signature Encoding
21    @param msghash          The hash to encode
22    @param msghashlen       The length of the hash (octets)
23    @param saltlen          The length of the salt desired (octets)
24    @param prng             An active PRNG context
25    @param prng_idx         The index of the PRNG desired
26    @param hash_idx         The index of the hash desired
27    @param modulus_bitlen   The bit length of the RSA modulus
28    @param out              [out] The destination of the encoding
29    @param outlen           [in/out] The max size and resulting size of the encoded data
30    @return CRYPT_OK if successful
31 */
pkcs_1_pss_encode(const unsigned char * msghash,unsigned long msghashlen,unsigned long saltlen,prng_state * prng,int prng_idx,int hash_idx,unsigned long modulus_bitlen,unsigned char * out,unsigned long * outlen)32 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
33                             unsigned long saltlen,  prng_state   *prng,
34                             int           prng_idx, int           hash_idx,
35                             unsigned long modulus_bitlen,
36                             unsigned char *out,     unsigned long *outlen)
37 {
38    unsigned char *DB, *mask, *salt, *hash;
39    unsigned long x, y, hLen, modulus_len;
40    int           err;
41    hash_state    md;
42 
43    LTC_ARGCHK(msghash != NULL);
44    LTC_ARGCHK(out     != NULL);
45    LTC_ARGCHK(outlen  != NULL);
46 
47    /* ensure hash and PRNG are valid */
48    if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
49       return err;
50    }
51    if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
52       return err;
53    }
54 
55    hLen        = hash_descriptor[hash_idx]->hashsize;
56    modulus_bitlen--;
57    modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
58 
59    /* check sizes */
60    if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2)) {
61       return CRYPT_PK_INVALID_SIZE;
62    }
63 
64    /* allocate ram for DB/mask/salt/hash of size modulus_len */
65    DB   = XMALLOC(modulus_len);
66    mask = XMALLOC(modulus_len);
67    salt = XMALLOC(modulus_len);
68    hash = XMALLOC(modulus_len);
69    if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
70       if (DB != NULL) {
71          XFREE(DB);
72       }
73       if (mask != NULL) {
74          XFREE(mask);
75       }
76       if (salt != NULL) {
77          XFREE(salt);
78       }
79       if (hash != NULL) {
80          XFREE(hash);
81       }
82       return CRYPT_MEM;
83    }
84 
85 
86    /* generate random salt */
87    if (saltlen > 0) {
88       if (prng_descriptor[prng_idx]->read(salt, saltlen, prng) != saltlen) {
89          err = CRYPT_ERROR_READPRNG;
90          goto LBL_ERR;
91       }
92    }
93 
94    /* M = (eight) 0x00 || msghash || salt, hash = H(M) */
95    if ((err = hash_descriptor[hash_idx]->init(&md)) != CRYPT_OK) {
96       goto LBL_ERR;
97    }
98    zeromem(DB, 8);
99    if ((err = hash_descriptor[hash_idx]->process(&md, DB, 8)) != CRYPT_OK) {
100       goto LBL_ERR;
101    }
102    if ((err = hash_descriptor[hash_idx]->process(&md, msghash, msghashlen)) != CRYPT_OK) {
103       goto LBL_ERR;
104    }
105    if ((err = hash_descriptor[hash_idx]->process(&md, salt, saltlen)) != CRYPT_OK) {
106       goto LBL_ERR;
107    }
108    if ((err = hash_descriptor[hash_idx]->done(&md, hash)) != CRYPT_OK) {
109       goto LBL_ERR;
110    }
111 
112    /* generate DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
113    x = 0;
114    XMEMSET(DB + x, 0, modulus_len - saltlen - hLen - 2);
115    x += modulus_len - saltlen - hLen - 2;
116    DB[x++] = 0x01;
117    XMEMCPY(DB + x, salt, saltlen);
118    /* x += saltlen; */
119 
120    /* generate mask of length modulus_len - hLen - 1 from hash */
121    if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
122       goto LBL_ERR;
123    }
124 
125    /* xor against DB */
126    for (y = 0; y < (modulus_len - hLen - 1); y++) {
127       DB[y] ^= mask[y];
128    }
129 
130    /* output is DB || hash || 0xBC */
131    if (*outlen < modulus_len) {
132       *outlen = modulus_len;
133       err = CRYPT_BUFFER_OVERFLOW;
134       goto LBL_ERR;
135    }
136 
137    /* DB len = modulus_len - hLen - 1 */
138    y = 0;
139    XMEMCPY(out + y, DB, modulus_len - hLen - 1);
140    y += modulus_len - hLen - 1;
141 
142    /* hash */
143    XMEMCPY(out + y, hash, hLen);
144    y += hLen;
145 
146    /* 0xBC */
147    out[y] = 0xBC;
148 
149    /* now clear the 8*modulus_len - modulus_bitlen most significant bits */
150    out[0] &= 0xFF >> ((modulus_len<<3) - modulus_bitlen);
151 
152    /* store output size */
153    *outlen = modulus_len;
154    err = CRYPT_OK;
155 LBL_ERR:
156 #ifdef LTC_CLEAN_STACK
157    zeromem(DB,   modulus_len);
158    zeromem(mask, modulus_len);
159    zeromem(salt, modulus_len);
160    zeromem(hash, modulus_len);
161 #endif
162 
163    XFREE(hash);
164    XFREE(salt);
165    XFREE(mask);
166    XFREE(DB);
167 
168    return err;
169 }
170 
171 #endif /* LTC_PKCS_1 */
172 
173 /* ref:         $Format:%D$ */
174 /* git commit:  $Format:%H$ */
175 /* commit time: $Format:%ai$ */
176