1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 #include <fault_mitigation.h>
4 #include "tomcrypt_private.h"
5
6 /**
7 @file pkcs_1_pss_decode.c
8 PKCS #1 PSS Signature Padding, Tom St Denis
9 */
10
11 #ifdef LTC_PKCS_1
12
13 /**
14 PKCS #1 v2.00 PSS decode
15 @param msghash The hash to verify
16 @param msghashlen The length of the hash (octets)
17 @param sig The signature data (encoded data)
18 @param siglen The length of the signature data (octets)
19 @param saltlen The length of the salt used (octets)
20 @param hash_idx The index of the hash desired
21 @param modulus_bitlen The bit length of the RSA modulus
22 @param res [out] The result of the comparison, 1==valid, 0==invalid
23 @return CRYPT_OK if successful (even if the comparison failed)
24 */
pkcs_1_pss_decode(const unsigned char * msghash,unsigned long msghashlen,const unsigned char * sig,unsigned long siglen,unsigned long saltlen,int hash_idx,unsigned long modulus_bitlen,int * res)25 int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
26 const unsigned char *sig, unsigned long siglen,
27 unsigned long saltlen, int hash_idx,
28 unsigned long modulus_bitlen, int *res)
29 {
30 unsigned char *DB, *mask, *salt, *hash;
31 unsigned long x, y, hLen, modulus_len;
32 int err;
33 hash_state md;
34
35 LTC_ARGCHK(msghash != NULL);
36 LTC_ARGCHK(res != NULL);
37
38 /* default to invalid */
39 *res = 0;
40
41 /* ensure hash is valid */
42 if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
43 return err;
44 }
45
46 hLen = hash_descriptor[hash_idx]->hashsize;
47 modulus_bitlen--;
48 modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
49
50 /* check sizes */
51 if ((saltlen > modulus_len) ||
52 (modulus_len < hLen + saltlen + 2)) {
53 return CRYPT_PK_INVALID_SIZE;
54 }
55
56 /* allocate ram for DB/mask/salt/hash of size modulus_len */
57 DB = XMALLOC(modulus_len);
58 mask = XMALLOC(modulus_len);
59 salt = XMALLOC(modulus_len);
60 hash = XMALLOC(modulus_len);
61 if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
62 if (DB != NULL) {
63 XFREE(DB);
64 }
65 if (mask != NULL) {
66 XFREE(mask);
67 }
68 if (salt != NULL) {
69 XFREE(salt);
70 }
71 if (hash != NULL) {
72 XFREE(hash);
73 }
74 return CRYPT_MEM;
75 }
76
77 /* ensure the 0xBC byte */
78 if (sig[siglen-1] != 0xBC) {
79 err = CRYPT_INVALID_PACKET;
80 goto LBL_ERR;
81 }
82
83 /* copy out the DB */
84 x = 0;
85 XMEMCPY(DB, sig + x, modulus_len - hLen - 1);
86 x += modulus_len - hLen - 1;
87
88 /* copy out the hash */
89 XMEMCPY(hash, sig + x, hLen);
90 /* x += hLen; */
91
92 /* check the MSB */
93 if ((sig[0] & ~(0xFF >> ((modulus_len<<3) - (modulus_bitlen)))) != 0) {
94 err = CRYPT_INVALID_PACKET;
95 goto LBL_ERR;
96 }
97
98 /* generate mask of length modulus_len - hLen - 1 from hash */
99 if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
100 goto LBL_ERR;
101 }
102
103 /* xor against DB */
104 for (y = 0; y < (modulus_len - hLen - 1); y++) {
105 DB[y] ^= mask[y];
106 }
107
108 /* now clear the first byte [make sure smaller than modulus] */
109 DB[0] &= 0xFF >> ((modulus_len<<3) - (modulus_bitlen));
110
111 /* DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
112
113 /* check for zeroes and 0x01 */
114 for (x = 0; x < modulus_len - saltlen - hLen - 2; x++) {
115 if (DB[x] != 0x00) {
116 err = CRYPT_INVALID_PACKET;
117 goto LBL_ERR;
118 }
119 }
120
121 /* check for the 0x01 */
122 if (DB[x++] != 0x01) {
123 err = CRYPT_INVALID_PACKET;
124 goto LBL_ERR;
125 }
126
127 /* M = (eight) 0x00 || msghash || salt, mask = H(M) */
128 if ((err = hash_descriptor[hash_idx]->init(&md)) != CRYPT_OK) {
129 goto LBL_ERR;
130 }
131 zeromem(mask, 8);
132 if ((err = hash_descriptor[hash_idx]->process(&md, mask, 8)) != CRYPT_OK) {
133 goto LBL_ERR;
134 }
135 if ((err = hash_descriptor[hash_idx]->process(&md, msghash, msghashlen)) != CRYPT_OK) {
136 goto LBL_ERR;
137 }
138 if ((err = hash_descriptor[hash_idx]->process(&md, DB+x, saltlen)) != CRYPT_OK) {
139 goto LBL_ERR;
140 }
141 if ((err = hash_descriptor[hash_idx]->done(&md, mask)) != CRYPT_OK) {
142 goto LBL_ERR;
143 }
144
145 /* mask == hash means valid signature */
146 if (FTMN_CALLEE_DONE_MEMCMP(XMEM_NEQ, mask, hash, hLen) == 0) {
147 *res = 1;
148 }
149
150 err = CRYPT_OK;
151 LBL_ERR:
152 #ifdef LTC_CLEAN_STACK
153 zeromem(DB, modulus_len);
154 zeromem(mask, modulus_len);
155 zeromem(salt, modulus_len);
156 zeromem(hash, modulus_len);
157 #endif
158
159 XFREE(hash);
160 XFREE(salt);
161 XFREE(mask);
162 XFREE(DB);
163
164 return err;
165 }
166
167 #endif /* LTC_PKCS_1 */
168