src/libstrongswan/crypto/rsa/rsa_public_key.c

   1 /**
   2  * @file rsa_public_key.c
   3  *
   4  * @brief Implementation of rsa_public_key_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2006 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  *
  23  * RCSID $Id$
  24  */
  25
  26 #include <gmp.h>
  27 #include <sys/stat.h>
  28 #include <unistd.h>
  29 #include <stdio.h>
  30 #include <string.h>
  31
  32 #include "rsa_public_key.h"
  33
  34 #include <debug.h>
  35 #include <crypto/hashers/hasher.h>
  36 #include <asn1/asn1.h>
  37 #include <asn1/pem.h>
  38
  39 /* ASN.1 definition of RSApublicKey */
  40 static const asn1Object_t pubkeyObjects[] = {
  41         { 0, "RSAPublicKey",            ASN1_SEQUENCE,     ASN1_OBJ  }, /*  0 */
  42         { 1,   "modulus",                       ASN1_INTEGER,      ASN1_BODY }, /*  1 */
  43         { 1,   "publicExponent",        ASN1_INTEGER,      ASN1_BODY }, /*  2 */
  44 };
  45
  46 #define PUB_KEY_RSA_PUBLIC_KEY          0
  47 #define PUB_KEY_MODULUS                         1
  48 #define PUB_KEY_EXPONENT                        2
  49 #define PUB_KEY_ROOF                            3
  50
  51 /* ASN.1 definition of digestInfo */
  52 static const asn1Object_t digestInfoObjects[] = {
  53         { 0, "digestInfo",                      ASN1_SEQUENCE,          ASN1_OBJ  }, /*  0 */
  54         { 1,   "digestAlgorithm",       ASN1_EOC,                       ASN1_RAW  }, /*  1 */
  55         { 1,   "digest",                        ASN1_OCTET_STRING,      ASN1_BODY }, /*  2 */
  56 };
  57
  58 #define DIGEST_INFO                                     0
  59 #define DIGEST_INFO_ALGORITHM           1
  60 #define DIGEST_INFO_DIGEST                      2
  61 #define DIGEST_INFO_ROOF                        3
  62
  63 typedef struct private_rsa_public_key_t private_rsa_public_key_t;
  64
  65 /**
  66  * Private data structure with signing context.
  67  */
  68 struct private_rsa_public_key_t {
  69         /**
  70          * Public interface for this signer.
  71          */
  72         rsa_public_key_t public;
  73
  74         /**
  75          * Public modulus.
  76          */
  77         mpz_t n;
  78
  79         /**
  80          * Public exponent.
  81          */
  82         mpz_t e;
  83
  84         /**
  85          * Keysize in bytes.
  86          */
  87         size_t k;
  88
  89         /**
  90          * Keyid formed as a SHA-1 hash of a publicKeyInfo object
  91          */
  92         chunk_t keyid;
  93
  94         /**
  95          * @brief Implements the RSAEP algorithm specified in PKCS#1.
  96          *
  97          * @param this          calling object
  98          * @param data          data to process
  99          * @return                      processed data
 100          */
 101         chunk_t (*rsaep) (const private_rsa_public_key_t *this, chunk_t data);
 102
 103         /**
 104          * @brief Implements the RSASVP1 algorithm specified in PKCS#1.
 105          *
 106          * @param this          calling object
 107          * @param data          data to process
 108          * @return                      processed data
 109          */
 110         chunk_t (*rsavp1) (const private_rsa_public_key_t *this, chunk_t data);
 111 };
 112
 113 private_rsa_public_key_t *rsa_public_key_create_empty(void);
 114
 115 /**
 116  * Implementation of private_rsa_public_key_t.rsaep and private_rsa_public_key_t.rsavp1
 117  */
 118 static chunk_t rsaep(const private_rsa_public_key_t *this, chunk_t data)
 119 {
 120         mpz_t m, c;
 121         chunk_t encrypted;
 122
 123         mpz_init(c);
 124         mpz_init(m);
 125
 126         mpz_import(m, data.len, 1, 1, 1, 0, data.ptr);
 127
 128         mpz_powm(c, m, this->e, this->n);
 129
 130     encrypted.len = this->k;
 131     encrypted.ptr = mpz_export(NULL, NULL, 1, encrypted.len, 1, 0, c);
 132
 133         mpz_clear(c);
 134         mpz_clear(m);
 135
 136         return encrypted;
 137 }
 138
 139 /**
 140  * Implementation of rsa_public_key.verify_emsa_pkcs1_signature.
 141  */
 142 static status_t verify_emsa_pkcs1_signature(const private_rsa_public_key_t *this,
 143                                                                                         hash_algorithm_t algorithm,
 144                                                                                         chunk_t data, chunk_t signature)
 145 {
 146         chunk_t em_ori, em;
 147         status_t res = FAILED;
 148
 149         /* remove any preceding 0-bytes from signature */
 150         while (signature.len && *(signature.ptr) == 0x00)
 151         {
 152                 signature.len -= 1;
 153                 signature.ptr++;
 154         }
 155
 156         if (signature.len > this->k)
 157         {
 158                 return INVALID_ARG;
 159         }
 160
 161         /* unpack signature */
 162         em_ori = em = this->rsavp1(this, signature);
 163
 164         /* result should look like this:
 165          * EM = 0x00 || 0x01 || PS || 0x00 || T.
 166          * PS = 0xFF padding, with length to fill em
 167          * T = oid || hash
 168          */
 169
 170         /* check magic bytes */
 171         if (*(em.ptr) != 0x00 || *(em.ptr+1) != 0x01)
 172         {
 173                 DBG2("incorrect padding - probably wrong RSA key");
 174                 goto end;
 175         }
 176         em.ptr += 2;
 177         em.len -= 2;
 178
 179         /* find magic 0x00 */
 180         while (em.len > 0)
 181         {
 182                 if (*em.ptr == 0x00)
 183                 {
 184                         /* found magic byte, stop */
 185                         em.ptr++;
 186                         em.len--;
 187                         break;
 188                 }
 189                 else if (*em.ptr != 0xFF)
 190                 {
 191                         /* bad padding, decryption failed ?!*/
 192                         goto end;
 193                 }
 194                 em.ptr++;
 195                 em.len--;
 196         }
 197
 198         if (em.len == 0)
 199         {
 200                 /* no digestInfo found */
 201                 goto end;
 202         }
 203
 204         /* parse ASN.1-based digestInfo */
 205         {
 206                 asn1_ctx_t ctx;
 207                 chunk_t object;
 208                 u_int level;
 209                 int objectID = 0;
 210                 hash_algorithm_t hash_algorithm = HASH_UNKNOWN;
 211
 212                 asn1_init(&ctx, em, 0, FALSE, FALSE);
 213
 214                 while (objectID < DIGEST_INFO_ROOF)
 215                 {
 216                         if (!extract_object(digestInfoObjects, &objectID, &object, &level, &ctx))
 217                         {
 218                                 goto end;
 219                         }
 220                         switch (objectID)
 221                         {
 222                                 case DIGEST_INFO:
 223                                         if (em.len > object.len)
 224                                         {
 225                                                 DBG1("digestInfo field in signature is followed by %u surplus bytes",
 226                                                          em.len - object.len);
 227                                                 goto end;
 228                                         }
 229                                         break;
 230                                 case DIGEST_INFO_ALGORITHM:
 231                                         {
 232                                                 int hash_oid = parse_algorithmIdentifier(object, level+1, NULL);
 233
 234                                                 hash_algorithm = hasher_algorithm_from_oid(hash_oid);
 235                                                 if (hash_algorithm == HASH_UNKNOWN
 236                                                 || (algorithm != HASH_UNKNOWN && hash_algorithm != algorithm))
 237                                                 {
 238                                                         DBG1("wrong hash algorithm used in signature");
 239                                                         goto end;
 240                                                 }
 241                                         }
 242                                         break;
 243                                 case DIGEST_INFO_DIGEST:
 244                                         {
 245                                                 chunk_t hash;
 246                                                 hasher_t *hasher = hasher_create(hash_algorithm);
 247
 248                                                 if (object.len != hasher->get_hash_size(hasher))
 249                                                 {
 250                                                         DBG1("hash size in signature is %u bytes instead of %u bytes",
 251                                                                  object.len, hasher->get_hash_size(hasher));
 252                                                         hasher->destroy(hasher);
 253                                                         goto end;
 254                                                 }
 255
 256                                                 /* build our own hash */
 257                                                 hasher->allocate_hash(hasher, data, &hash);
 258                                                 hasher->destroy(hasher);
 259
 260                                                 /* compare the hashes */
 261                                                 res = memeq(object.ptr, hash.ptr, hash.len) ? SUCCESS : FAILED;
 262                                                 free(hash.ptr);
 263                                         }
 264                                         break;
 265                                 default:
 266                                         break;
 267                         }
 268                         objectID++;
 269                 }
 270         }
 271
 272 end:
 273         free(em_ori.ptr);
 274         return res;
 275 }
 276
 277 /**
 278  * Implementation of rsa_public_key.get_key.
 279  */
 280 static status_t get_key(const private_rsa_public_key_t *this, chunk_t *key)
 281 {
 282         chunk_t n, e;
 283
 284         n.len = this->k;
 285         n.ptr = mpz_export(NULL, NULL, 1, n.len, 1, 0, this->n);
 286         e.len = this->k;
 287         e.ptr = mpz_export(NULL, NULL, 1, e.len, 1, 0, this->e);
 288
 289         key->len = this->k * 2;
 290         key->ptr = malloc(key->len);
 291         memcpy(key->ptr, n.ptr, n.len);
 292         memcpy(key->ptr + n.len, e.ptr, e.len);
 293         free(n.ptr);
 294         free(e.ptr);
 295
 296         return SUCCESS;
 297 }
 298
 299 /**
 300  * Implementation of rsa_public_key.save_key.
 301  */
 302 static status_t save_key(const private_rsa_public_key_t *this, char *file)
 303 {
 304         return NOT_SUPPORTED;
 305 }
 306
 307 /**
 308  * Implementation of rsa_public_key.get_modulus.
 309  */
 310 static mpz_t *get_modulus(const private_rsa_public_key_t *this)
 311 {
 312         return (mpz_t*)&this->n;
 313 }
 314
 315 /**
 316  * Implementation of rsa_public_key.get_keysize.
 317  */
 318 static size_t get_keysize(const private_rsa_public_key_t *this)
 319 {
 320         return this->k;
 321 }
 322
 323 /**
 324  * Implementation of rsa_public_key.get_keyid.
 325  */
 326 static chunk_t get_keyid(const private_rsa_public_key_t *this)
 327 {
 328         return this->keyid;
 329 }
 330
 331 /**
 332  * Implementation of rsa_public_key.clone.
 333  */
 334 static rsa_public_key_t* _clone(const private_rsa_public_key_t *this)
 335 {
 336         private_rsa_public_key_t *clone = rsa_public_key_create_empty();
 337
 338         mpz_init_set(clone->n, this->n);
 339         mpz_init_set(clone->e, this->e);
 340         clone->keyid = chunk_clone(this->keyid);
 341         clone->k = this->k;
 342
 343         return &clone->public;
 344 }
 345
 346 /**
 347  * Implementation of rsa_public_key.destroy.
 348  */
 349 static void destroy(private_rsa_public_key_t *this)
 350 {
 351         mpz_clear(this->n);
 352         mpz_clear(this->e);
 353         free(this->keyid.ptr);
 354         free(this);
 355 }
 356
 357 /**
 358  * Generic private constructor
 359  */
 360 private_rsa_public_key_t *rsa_public_key_create_empty(void)
 361 {
 362         private_rsa_public_key_t *this = malloc_thing(private_rsa_public_key_t);
 363
 364         /* public functions */
 365         this->public.verify_emsa_pkcs1_signature = (status_t (*) (const rsa_public_key_t*,hash_algorithm_t,chunk_t,chunk_t))verify_emsa_pkcs1_signature;
 366         this->public.get_key = (status_t (*) (const rsa_public_key_t*,chunk_t*))get_key;
 367         this->public.save_key = (status_t (*) (const rsa_public_key_t*,char*))save_key;
 368         this->public.get_modulus = (mpz_t *(*) (const rsa_public_key_t*))get_modulus;
 369         this->public.get_keysize = (size_t (*) (const rsa_public_key_t*))get_keysize;
 370         this->public.get_keyid = (chunk_t (*) (const rsa_public_key_t*))get_keyid;
 371         this->public.clone = (rsa_public_key_t* (*) (const rsa_public_key_t*))_clone;
 372         this->public.destroy = (void (*) (rsa_public_key_t*))destroy;
 373
 374         /* private functions */
 375         this->rsaep = rsaep;
 376         this->rsavp1 = rsaep; /* same algorithm */
 377
 378         return this;
 379 }
 380
 381 /**
 382  * Build a DER-encoded publicKeyInfo object from an RSA public key.
 383  * Also used in rsa_private_key.c.
 384  */
 385 chunk_t rsa_public_key_info_to_asn1(const mpz_t n, const mpz_t e)
 386 {
 387         chunk_t rawKey = asn1_wrap(ASN1_SEQUENCE, "mm",
 388                                                                  asn1_integer_from_mpz(n),
 389                                                                  asn1_integer_from_mpz(e));
 390         chunk_t publicKey;
 391
 392         u_char *pos = build_asn1_object(&publicKey, ASN1_BIT_STRING, 1 + rawKey.len);
 393
 394         *pos++ = 0x00;
 395         memcpy(pos, rawKey.ptr, rawKey.len);
 396         free(rawKey.ptr);
 397
 398         return asn1_wrap(ASN1_SEQUENCE, "cm", ASN1_rsaEncryption_id,
 399                                                                                   publicKey);
 400 }
 401
 402 /*
 403  * See header
 404  */
 405 rsa_public_key_t *rsa_public_key_create_from_chunk(chunk_t blob)
 406 {
 407         asn1_ctx_t ctx;
 408         chunk_t object;
 409         u_int level;
 410         int objectID = 0;
 411
 412         private_rsa_public_key_t *this = rsa_public_key_create_empty();
 413
 414         mpz_init(this->n);
 415         mpz_init(this->e);
 416
 417         asn1_init(&ctx, blob, 0, FALSE, FALSE);
 418
 419         while (objectID < PUB_KEY_ROOF)
 420         {
 421                 if (!extract_object(pubkeyObjects, &objectID, &object, &level, &ctx))
 422                 {
 423                         destroy(this);
 424                         return FALSE;
 425                 }
 426                 switch (objectID)
 427                 {
 428                         case PUB_KEY_MODULUS:
 429                                 mpz_import(this->n, object.len, 1, 1, 1, 0, object.ptr);
 430                                 break;
 431                         case PUB_KEY_EXPONENT:
 432                                 mpz_import(this->e, object.len, 1, 1, 1, 0, object.ptr);
 433                                 break;
 434                 }
 435                 objectID++;
 436         }
 437
 438         this->k = (mpz_sizeinbase(this->n, 2) + 7) / 8;
 439
 440         /* form the keyid as a SHA-1 hash of a publicKeyInfo object */
 441         {
 442                 chunk_t publicKeyInfo = rsa_public_key_info_to_asn1(this->n, this->e);
 443                 hasher_t *hasher = hasher_create(HASH_SHA1);
 444
 445                 hasher->allocate_hash(hasher, publicKeyInfo, &this->keyid);
 446                 hasher->destroy(hasher);
 447                 free(publicKeyInfo.ptr);
 448         }
 449
 450         return &this->public;
 451 }
 452
 453 /*
 454  * See header
 455  */
 456 rsa_public_key_t *rsa_public_key_create_from_file(char *filename)
 457 {
 458         bool pgp = FALSE;
 459         chunk_t chunk = chunk_empty;
 460         rsa_public_key_t *pubkey = NULL;
 461
 462         if (!pem_asn1_load_file(filename, NULL, "public key", &chunk, &pgp))
 463                 return NULL;
 464
 465         pubkey = rsa_public_key_create_from_chunk(chunk);
 466         free(chunk.ptr);
 467         return pubkey;
 468 }