1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 #include "tomcrypt_private.h"
4 
5 /**
6   @file pkcs_1_pss_encode.c
7   PKCS #1 PSS Signature Padding, Tom St Denis
8 */
9 
10 #ifdef LTC_PKCS_1
11 
12 /**
13    PKCS #1 v2.00 Signature Encoding
14    @param msghash          The hash to encode
15    @param msghashlen       The length of the hash (octets)
16    @param saltlen          The length of the salt desired (octets)
17    @param prng             An active PRNG context
18    @param prng_idx         The index of the PRNG desired
19    @param hash_idx         The index of the hash desired
20    @param modulus_bitlen   The bit length of the RSA modulus
21    @param out              [out] The destination of the encoding
22    @param outlen           [in/out] The max size and resulting size of the encoded data
23    @return CRYPT_OK if successful
24 */
pkcs_1_pss_encode(const unsigned char * msghash,unsigned long msghashlen,unsigned long saltlen,prng_state * prng,int prng_idx,int hash_idx,unsigned long modulus_bitlen,unsigned char * out,unsigned long * outlen)25 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
26                             unsigned long saltlen,  prng_state   *prng,
27                             int           prng_idx, int           hash_idx,
28                             unsigned long modulus_bitlen,
29                             unsigned char *out,     unsigned long *outlen)
30 {
31    unsigned char *DB, *mask, *salt, *hash;
32    unsigned long x, y, hLen, modulus_len;
33    int           err;
34    hash_state    md;
35 
36    LTC_ARGCHK(msghash != NULL);
37    LTC_ARGCHK(out     != NULL);
38    LTC_ARGCHK(outlen  != NULL);
39 
40    /* ensure hash and PRNG are valid */
41    if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
42       return err;
43    }
44    if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
45       return err;
46    }
47 
48    hLen        = hash_descriptor[hash_idx]->hashsize;
49    modulus_bitlen--;
50    modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
51 
52    /* check sizes */
53    if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2)) {
54       return CRYPT_PK_INVALID_SIZE;
55    }
56 
57    /* allocate ram for DB/mask/salt/hash of size modulus_len */
58    DB   = XMALLOC(modulus_len);
59    mask = XMALLOC(modulus_len);
60    salt = XMALLOC(modulus_len);
61    hash = XMALLOC(modulus_len);
62    if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
63       if (DB != NULL) {
64          XFREE(DB);
65       }
66       if (mask != NULL) {
67          XFREE(mask);
68       }
69       if (salt != NULL) {
70          XFREE(salt);
71       }
72       if (hash != NULL) {
73          XFREE(hash);
74       }
75       return CRYPT_MEM;
76    }
77 
78 
79    /* generate random salt */
80    if (saltlen > 0) {
81       if (prng_descriptor[prng_idx]->read(salt, saltlen, prng) != saltlen) {
82          err = CRYPT_ERROR_READPRNG;
83          goto LBL_ERR;
84       }
85    }
86 
87    /* M = (eight) 0x00 || msghash || salt, hash = H(M) */
88    if ((err = hash_descriptor[hash_idx]->init(&md)) != CRYPT_OK) {
89       goto LBL_ERR;
90    }
91    zeromem(DB, 8);
92    if ((err = hash_descriptor[hash_idx]->process(&md, DB, 8)) != CRYPT_OK) {
93       goto LBL_ERR;
94    }
95    if ((err = hash_descriptor[hash_idx]->process(&md, msghash, msghashlen)) != CRYPT_OK) {
96       goto LBL_ERR;
97    }
98    if ((err = hash_descriptor[hash_idx]->process(&md, salt, saltlen)) != CRYPT_OK) {
99       goto LBL_ERR;
100    }
101    if ((err = hash_descriptor[hash_idx]->done(&md, hash)) != CRYPT_OK) {
102       goto LBL_ERR;
103    }
104 
105    /* generate DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
106    x = 0;
107    XMEMSET(DB + x, 0, modulus_len - saltlen - hLen - 2);
108    x += modulus_len - saltlen - hLen - 2;
109    DB[x++] = 0x01;
110    XMEMCPY(DB + x, salt, saltlen);
111    /* x += saltlen; */
112 
113    /* generate mask of length modulus_len - hLen - 1 from hash */
114    if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
115       goto LBL_ERR;
116    }
117 
118    /* xor against DB */
119    for (y = 0; y < (modulus_len - hLen - 1); y++) {
120       DB[y] ^= mask[y];
121    }
122 
123    /* output is DB || hash || 0xBC */
124    if (*outlen < modulus_len) {
125       *outlen = modulus_len;
126       err = CRYPT_BUFFER_OVERFLOW;
127       goto LBL_ERR;
128    }
129 
130    /* DB len = modulus_len - hLen - 1 */
131    y = 0;
132    XMEMCPY(out + y, DB, modulus_len - hLen - 1);
133    y += modulus_len - hLen - 1;
134 
135    /* hash */
136    XMEMCPY(out + y, hash, hLen);
137    y += hLen;
138 
139    /* 0xBC */
140    out[y] = 0xBC;
141 
142    /* now clear the 8*modulus_len - modulus_bitlen most significant bits */
143    out[0] &= 0xFF >> ((modulus_len<<3) - modulus_bitlen);
144 
145    /* store output size */
146    *outlen = modulus_len;
147    err = CRYPT_OK;
148 LBL_ERR:
149 #ifdef LTC_CLEAN_STACK
150    zeromem(DB,   modulus_len);
151    zeromem(mask, modulus_len);
152    zeromem(salt, modulus_len);
153    zeromem(hash, modulus_len);
154 #endif
155 
156    XFREE(hash);
157    XFREE(salt);
158    XFREE(mask);
159    XFREE(DB);
160 
161    return err;
162 }
163 
164 #endif /* LTC_PKCS_1 */
165