1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 #include "tomcrypt_private.h"
4
5 /**
6 @file pkcs_1_pss_encode.c
7 PKCS #1 PSS Signature Padding, Tom St Denis
8 */
9
10 #ifdef LTC_PKCS_1
11
12 /**
13 PKCS #1 v2.00 Signature Encoding
14 @param msghash The hash to encode
15 @param msghashlen The length of the hash (octets)
16 @param saltlen The length of the salt desired (octets)
17 @param prng An active PRNG context
18 @param prng_idx The index of the PRNG desired
19 @param hash_idx The index of the hash desired
20 @param modulus_bitlen The bit length of the RSA modulus
21 @param out [out] The destination of the encoding
22 @param outlen [in/out] The max size and resulting size of the encoded data
23 @return CRYPT_OK if successful
24 */
pkcs_1_pss_encode(const unsigned char * msghash,unsigned long msghashlen,unsigned long saltlen,prng_state * prng,int prng_idx,int hash_idx,unsigned long modulus_bitlen,unsigned char * out,unsigned long * outlen)25 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
26 unsigned long saltlen, prng_state *prng,
27 int prng_idx, int hash_idx,
28 unsigned long modulus_bitlen,
29 unsigned char *out, unsigned long *outlen)
30 {
31 unsigned char *DB, *mask, *salt, *hash;
32 unsigned long x, y, hLen, modulus_len;
33 int err;
34 hash_state md;
35
36 LTC_ARGCHK(msghash != NULL);
37 LTC_ARGCHK(out != NULL);
38 LTC_ARGCHK(outlen != NULL);
39
40 /* ensure hash and PRNG are valid */
41 if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
42 return err;
43 }
44 if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
45 return err;
46 }
47
48 hLen = hash_descriptor[hash_idx]->hashsize;
49 modulus_bitlen--;
50 modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
51
52 /* check sizes */
53 if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2)) {
54 return CRYPT_PK_INVALID_SIZE;
55 }
56
57 /* allocate ram for DB/mask/salt/hash of size modulus_len */
58 DB = XMALLOC(modulus_len);
59 mask = XMALLOC(modulus_len);
60 salt = XMALLOC(modulus_len);
61 hash = XMALLOC(modulus_len);
62 if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
63 if (DB != NULL) {
64 XFREE(DB);
65 }
66 if (mask != NULL) {
67 XFREE(mask);
68 }
69 if (salt != NULL) {
70 XFREE(salt);
71 }
72 if (hash != NULL) {
73 XFREE(hash);
74 }
75 return CRYPT_MEM;
76 }
77
78
79 /* generate random salt */
80 if (saltlen > 0) {
81 if (prng_descriptor[prng_idx]->read(salt, saltlen, prng) != saltlen) {
82 err = CRYPT_ERROR_READPRNG;
83 goto LBL_ERR;
84 }
85 }
86
87 /* M = (eight) 0x00 || msghash || salt, hash = H(M) */
88 if ((err = hash_descriptor[hash_idx]->init(&md)) != CRYPT_OK) {
89 goto LBL_ERR;
90 }
91 zeromem(DB, 8);
92 if ((err = hash_descriptor[hash_idx]->process(&md, DB, 8)) != CRYPT_OK) {
93 goto LBL_ERR;
94 }
95 if ((err = hash_descriptor[hash_idx]->process(&md, msghash, msghashlen)) != CRYPT_OK) {
96 goto LBL_ERR;
97 }
98 if ((err = hash_descriptor[hash_idx]->process(&md, salt, saltlen)) != CRYPT_OK) {
99 goto LBL_ERR;
100 }
101 if ((err = hash_descriptor[hash_idx]->done(&md, hash)) != CRYPT_OK) {
102 goto LBL_ERR;
103 }
104
105 /* generate DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
106 x = 0;
107 XMEMSET(DB + x, 0, modulus_len - saltlen - hLen - 2);
108 x += modulus_len - saltlen - hLen - 2;
109 DB[x++] = 0x01;
110 XMEMCPY(DB + x, salt, saltlen);
111 /* x += saltlen; */
112
113 /* generate mask of length modulus_len - hLen - 1 from hash */
114 if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
115 goto LBL_ERR;
116 }
117
118 /* xor against DB */
119 for (y = 0; y < (modulus_len - hLen - 1); y++) {
120 DB[y] ^= mask[y];
121 }
122
123 /* output is DB || hash || 0xBC */
124 if (*outlen < modulus_len) {
125 *outlen = modulus_len;
126 err = CRYPT_BUFFER_OVERFLOW;
127 goto LBL_ERR;
128 }
129
130 /* DB len = modulus_len - hLen - 1 */
131 y = 0;
132 XMEMCPY(out + y, DB, modulus_len - hLen - 1);
133 y += modulus_len - hLen - 1;
134
135 /* hash */
136 XMEMCPY(out + y, hash, hLen);
137 y += hLen;
138
139 /* 0xBC */
140 out[y] = 0xBC;
141
142 /* now clear the 8*modulus_len - modulus_bitlen most significant bits */
143 out[0] &= 0xFF >> ((modulus_len<<3) - modulus_bitlen);
144
145 /* store output size */
146 *outlen = modulus_len;
147 err = CRYPT_OK;
148 LBL_ERR:
149 #ifdef LTC_CLEAN_STACK
150 zeromem(DB, modulus_len);
151 zeromem(mask, modulus_len);
152 zeromem(salt, modulus_len);
153 zeromem(hash, modulus_len);
154 #endif
155
156 XFREE(hash);
157 XFREE(salt);
158 XFREE(mask);
159 XFREE(DB);
160
161 return err;
162 }
163
164 #endif /* LTC_PKCS_1 */
165