Skip to content

Commit aa4bae5

Browse files
sjaeckelkarel-m
sjaeckel
authored and
karel-m
committed
add option to do PKCS#1 v1.5 EMSA without ASN.1 around hash
Somehow someone forgot to add the OID in the signature field of a SERVER_KEY_EXCHANGE message in early versions of the SSL protocol. Therefore provide an option to be able to sign/verify a message in that format.
1 parent 25878ed commit aa4bae5

File tree

3 files changed

+95
-69
lines changed

3 files changed

+95
-69
lines changed

‎src/headers/tomcrypt_pkcs.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ enum ltc_pkcs_1_paddings
1313
{
1414
LTC_PKCS_1_V1_5 = 1, /* PKCS #1 v1.5 padding (\sa ltc_pkcs_1_v1_5_blocks) */
1515
LTC_PKCS_1_OAEP = 2, /* PKCS #1 v2.0 encryption padding */
16-
LTC_PKCS_1_PSS = 3 /* PKCS #1 v2.1 signature padding */
16+
LTC_PKCS_1_PSS = 3, /* PKCS #1 v2.1 signature padding */
17+
LTC_PKCS_1_V1_5_NA1 = 4 /* PKCS #1 v1.5 padding - No ASN.1 (\sa ltc_pkcs_1_v1_5_blocks) */
1718
};
1819

1920
int pkcs_1_mgf1( int hash_idx,

‎src/pk/rsa/rsa_sign_hash.c‎

Lines changed: 45 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
@param inlen The length of the hash to sign (octets)
2424
@param out [out] The signature
2525
@param outlen [in/out] The max size and resulting size of the signature
26-
@param padding Type of padding (LTC_PKCS_1_PSS or LTC_PKCS_1_V1_5)
26+
@param padding Type of padding (LTC_PKCS_1_PSS, LTC_PKCS_1_V1_5 or LTC_PKCS_1_V1_5_NA1)
2727
@param prng An active PRNG state
2828
@param prng_idx The index of the PRNG desired
2929
@param hash_idx The index of the hash desired
@@ -47,15 +47,21 @@ int rsa_sign_hash_ex(const unsigned char *in, unsigned long inlen,
4747
LTC_ARGCHK(key != NULL);
4848

4949
/* valid padding? */
50-
if ((padding != LTC_PKCS_1_V1_5) && (padding != LTC_PKCS_1_PSS)) {
50+
if ((padding != LTC_PKCS_1_V1_5) &&
51+
(padding != LTC_PKCS_1_PSS) &&
52+
(padding != LTC_PKCS_1_V1_5_NA1)) {
5153
return CRYPT_PK_INVALID_PADDING;
5254
}
5355

5456
if (padding == LTC_PKCS_1_PSS) {
55-
/* valid prng and hash ? */
57+
/* valid prng ? */
5658
if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
5759
return err;
5860
}
61+
}
62+
63+
if (padding != LTC_PKCS_1_V1_5_NA1) {
64+
/* valid hash ? */
5965
if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
6066
return err;
6167
}
@@ -81,46 +87,54 @@ int rsa_sign_hash_ex(const unsigned char *in, unsigned long inlen,
8187
} else {
8288
/* PKCS #1 v1.5 pad the hash */
8389
unsigned char *tmpin;
84-
ltc_asn1_list digestinfo[2], siginfo[2];
8590

86-
/* not all hashes have OIDs... so sad */
87-
if (hash_descriptor[hash_idx].OIDlen == 0) {
88-
return CRYPT_INVALID_ARG;
89-
}
91+
if (padding == LTC_PKCS_1_V1_5) {
92+
ltc_asn1_list digestinfo[2], siginfo[2];
93+
/* not all hashes have OIDs... so sad */
94+
if (hash_descriptor[hash_idx].OIDlen == 0) {
95+
return CRYPT_INVALID_ARG;
96+
}
9097

9198
/* construct the SEQUENCE
92-
SEQUENCE {
93-
SEQUENCE {hashoid OID
94-
blah NULL
95-
}
99+
SEQUENCE {
100+
SEQUENCE {hashoid OID
101+
blah NULL
102+
}
96103
hash OCTET STRING
104+
}
105+
*/
106+
LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, hash_descriptor[hash_idx].OID, hash_descriptor[hash_idx].OIDlen);
107+
LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL, NULL, 0);
108+
LTC_SET_ASN1(siginfo, 0, LTC_ASN1_SEQUENCE, digestinfo, 2);
109+
LTC_SET_ASN1(siginfo, 1, LTC_ASN1_OCTET_STRING, in, inlen);
110+
111+
/* allocate memory for the encoding */
112+
y = mp_unsigned_bin_size(key->N);
113+
tmpin = XMALLOC(y);
114+
if (tmpin == NULL) {
115+
return CRYPT_MEM;
97116
}
98-
*/
99-
LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, hash_descriptor[hash_idx].OID, hash_descriptor[hash_idx].OIDlen);
100-
LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL, NULL, 0);
101-
LTC_SET_ASN1(siginfo, 0, LTC_ASN1_SEQUENCE, digestinfo, 2);
102-
LTC_SET_ASN1(siginfo, 1, LTC_ASN1_OCTET_STRING, in, inlen);
103-
104-
/* allocate memory for the encoding */
105-
y = mp_unsigned_bin_size(key->N);
106-
tmpin = XMALLOC(y);
107-
if (tmpin == NULL) {
108-
return CRYPT_MEM;
109-
}
110117

111-
if ((err = der_encode_sequence(siginfo, 2, tmpin, &y)) != CRYPT_OK) {
112-
XFREE(tmpin);
113-
return err;
118+
if ((err = der_encode_sequence(siginfo, 2, tmpin, &y)) != CRYPT_OK) {
119+
XFREE(tmpin);
120+
return err;
121+
}
122+
} else {
123+
/* set the pointer and data-length to the input values */
124+
tmpin = (unsigned char *)in;
125+
y = inlen;
114126
}
115127

116128
x = *outlen;
117-
if ((err = pkcs_1_v1_5_encode(tmpin, y, LTC_PKCS_1_EMSA,
118-
modulus_bitlen, NULL, 0,
119-
out, &x)) != CRYPT_OK) {
129+
err = pkcs_1_v1_5_encode(tmpin, y, LTC_PKCS_1_EMSA, modulus_bitlen, NULL, 0, out, &x);
130+
131+
if (padding == LTC_PKCS_1_V1_5) {
120132
XFREE(tmpin);
133+
}
134+
135+
if (err != CRYPT_OK) {
121136
return err;
122137
}
123-
XFREE(tmpin);
124138
}
125139

126140
/* RSA encode it */

‎src/pk/rsa/rsa_verify_hash.c‎

Lines changed: 48 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
@param siglen The length of the signature data (octets)
2424
@param hash The hash of the message that was signed
2525
@param hashlen The length of the hash of the message that was signed (octets)
26-
@param padding Type of padding (LTC_PKCS_1_PSS or LTC_PKCS_1_V1_5)
26+
@param padding Type of padding (LTC_PKCS_1_PSS, LTC_PKCS_1_V1_5 or LTC_PKCS_1_V1_5_NA1)
2727
@param hash_idx The index of the desired hash
2828
@param saltlen The length of the salt used during signature
2929
@param stat [out] The result of the signature comparison, 1==valid, 0==invalid
@@ -51,11 +51,12 @@ int rsa_verify_hash_ex(const unsigned char *sig, unsigned long siglen,
5151
/* valid padding? */
5252

5353
if ((padding != LTC_PKCS_1_V1_5) &&
54-
(padding != LTC_PKCS_1_PSS)) {
54+
(padding != LTC_PKCS_1_PSS) &&
55+
(padding != LTC_PKCS_1_V1_5_NA1)) {
5556
return CRYPT_PK_INVALID_PADDING;
5657
}
5758

58-
if (padding == LTC_PKCS_1_PSS) {
59+
if (padding != LTC_PKCS_1_V1_5_NA1) {
5960
/* valid hash ? */
6061
if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
6162
return err;
@@ -103,15 +104,8 @@ int rsa_verify_hash_ex(const unsigned char *sig, unsigned long siglen,
103104
} else {
104105
/* PKCS #1 v1.5 decode it */
105106
unsigned char *out;
106-
unsigned long outlen, loid[16], reallen;
107+
unsigned long outlen;
107108
int decoded;
108-
ltc_asn1_list digestinfo[2], siginfo[2];
109-
110-
/* not all hashes have OIDs... so sad */
111-
if (hash_descriptor[hash_idx].OIDlen == 0) {
112-
err = CRYPT_INVALID_ARG;
113-
goto bail_2;
114-
}
115109

116110
/* allocate temp buffer for decoded hash */
117111
outlen = ((modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0)) - 3;
@@ -126,37 +120,54 @@ int rsa_verify_hash_ex(const unsigned char *sig, unsigned long siglen,
126120
goto bail_2;
127121
}
128122

129-
/* now we must decode out[0...outlen-1] using ASN.1, test the OID and then test the hash */
130-
/* construct the SEQUENCE
131-
SEQUENCE {
132-
SEQUENCE {hashoid OID
133-
blah NULL
134-
}
135-
hash OCTET STRING
123+
if (padding == LTC_PKCS_1_V1_5) {
124+
unsigned long loid[16], reallen;
125+
ltc_asn1_list digestinfo[2], siginfo[2];
126+
127+
/* not all hashes have OIDs... so sad */
128+
if (hash_descriptor[hash_idx].OIDlen == 0) {
129+
err = CRYPT_INVALID_ARG;
130+
goto bail_2;
136131
}
137-
*/
138-
LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, loid, sizeof(loid)/sizeof(loid[0]));
139-
LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL, NULL, 0);
140-
LTC_SET_ASN1(siginfo, 0, LTC_ASN1_SEQUENCE, digestinfo, 2);
141-
LTC_SET_ASN1(siginfo, 1, LTC_ASN1_OCTET_STRING, tmpbuf, siglen);
142-
143-
if ((err = der_decode_sequence(out, outlen, siginfo, 2)) != CRYPT_OK) {
144-
XFREE(out);
145-
goto bail_2;
146-
}
147132

148-
if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
149-
XFREE(out);
150-
goto bail_2;
151-
}
133+
/* now we must decode out[0...outlen-1] using ASN.1, test the OID and then test the hash */
134+
/* construct the SEQUENCE
135+
SEQUENCE {
136+
SEQUENCE {hashoid OID
137+
blah NULL
138+
}
139+
hash OCTET STRING
140+
}
141+
*/
142+
LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, loid, sizeof(loid)/sizeof(loid[0]));
143+
LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL, NULL, 0);
144+
LTC_SET_ASN1(siginfo, 0, LTC_ASN1_SEQUENCE, digestinfo, 2);
145+
LTC_SET_ASN1(siginfo, 1, LTC_ASN1_OCTET_STRING, tmpbuf, siglen);
146+
147+
if ((err = der_decode_sequence(out, outlen, siginfo, 2)) != CRYPT_OK) {
148+
XFREE(out);
149+
goto bail_2;
150+
}
151+
152+
if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
153+
XFREE(out);
154+
goto bail_2;
155+
}
152156

153-
/* test OID */
154-
if ((reallen == outlen) &&
155-
(digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
157+
/* test OID */
158+
if ((reallen == outlen) &&
159+
(digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
156160
(XMEM_NEQ(digestinfo[0].data, hash_descriptor[hash_idx].OID, sizeof(unsigned long) * hash_descriptor[hash_idx].OIDlen) == 0) &&
157-
(siginfo[1].size == hashlen) &&
161+
(siginfo[1].size == hashlen) &&
158162
(XMEM_NEQ(siginfo[1].data, hash, hashlen) == 0)) {
159-
*stat = 1;
163+
*stat = 1;
164+
}
165+
} else {
166+
/* only check if the hash is equal */
167+
if ((hashlen == outlen) &&
168+
(XMEMCMP(out, hash, hashlen) == 0)) {
169+
*stat = 1;
170+
}
160171
}
161172

162173
#ifdef LTC_CLEAN_STACK

0 commit comments

Comments
 (0)