src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c

   1 /*
   2  * Copyright (C) 2005-2008 Martin Willi
   3  * Copyright (C) 2005 Jan Hutter
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <gmp.h>
  18 #include <sys/stat.h>
  19 #include <unistd.h>
  20 #include <stdio.h>
  21 #include <string.h>
  22
  23 #include "gmp_rsa_public_key.h"
  24
  25 #include <debug.h>
  26 #include <asn1/oid.h>
  27 #include <asn1/asn1.h>
  28 #include <asn1/asn1_parser.h>
  29 #include <asn1/pem.h>
  30 #include <crypto/hashers/hasher.h>
  31 #include <pgp/pgp.h>
  32
  33 typedef struct private_gmp_rsa_public_key_t private_gmp_rsa_public_key_t;
  34
  35 /**
  36  * Private data structure with signing context.
  37  */
  38 struct private_gmp_rsa_public_key_t {
  39         /**
  40          * Public interface for this signer.
  41          */
  42         gmp_rsa_public_key_t public;
  43
  44         /**
  45          * Public modulus.
  46          */
  47         mpz_t n;
  48
  49         /**
  50          * Public exponent.
  51          */
  52         mpz_t e;
  53
  54         /**
  55          * Keysize in bytes.
  56          */
  57         size_t k;
  58
  59         /**
  60          * Keyid formed as a SHA-1 hash of a publicKeyInfo object
  61          */
  62         identification_t *keyid_info;
  63
  64         /**
  65          * Keyid formed as a SHA-1 hash of a publicKey object
  66          */
  67         identification_t *keyid;
  68
  69         /**
  70          * reference counter
  71          */
  72         refcount_t ref;
  73 };
  74
  75 /**
  76  * Shared functions defined in gmp_rsa_private_key.c
  77  */
  78 extern chunk_t gmp_mpz_to_chunk(const mpz_t value);
  79 extern chunk_t gmp_mpz_to_asn1(const mpz_t value);
  80
  81 /**
  82  * RSAEP algorithm specified in PKCS#1.
  83  */
  84 static chunk_t rsaep(private_gmp_rsa_public_key_t *this, chunk_t data)
  85 {
  86         mpz_t m, c;
  87         chunk_t encrypted;
  88
  89         mpz_init(c);
  90         mpz_init(m);
  91
  92         mpz_import(m, data.len, 1, 1, 1, 0, data.ptr);
  93
  94         mpz_powm(c, m, this->e, this->n);
  95
  96         encrypted.len = this->k;
  97         encrypted.ptr = mpz_export(NULL, NULL, 1, encrypted.len, 1, 0, c);
  98         if (encrypted.ptr == NULL)
  99         {
 100                 encrypted.len = 0;
 101         }
 102
 103         mpz_clear(c);
 104         mpz_clear(m);
 105
 106         return encrypted;
 107 }
 108
 109 /**
 110  * RSAVP1 algorithm specified in PKCS#1.
 111  */
 112 static chunk_t rsavp1(private_gmp_rsa_public_key_t *this, chunk_t data)
 113 {
 114         return rsaep(this, data);
 115 }
 116
 117 /**
 118  * ASN.1 definition of digestInfo
 119  */
 120 static const asn1Object_t digestInfoObjects[] = {
 121         { 0, "digestInfo",                      ASN1_SEQUENCE,          ASN1_OBJ  }, /*  0 */
 122         { 1,   "digestAlgorithm",       ASN1_EOC,                       ASN1_RAW  }, /*  1 */
 123         { 1,   "digest",                        ASN1_OCTET_STRING,      ASN1_BODY }, /*  2 */
 124         { 0, "exit",                            ASN1_EOC,                       ASN1_EXIT }
 125 };
 126 #define DIGEST_INFO                                     0
 127 #define DIGEST_INFO_ALGORITHM           1
 128 #define DIGEST_INFO_DIGEST                      2
 129
 130 /**
 131  * Verification of an EMPSA PKCS1 signature described in PKCS#1
 132  */
 133 static bool verify_emsa_pkcs1_signature(private_gmp_rsa_public_key_t *this,
 134                                                                                 hash_algorithm_t algorithm,
 135                                                                                 chunk_t data, chunk_t signature)
 136 {
 137         chunk_t em_ori, em;
 138         bool success = FALSE;
 139
 140         /* remove any preceding 0-bytes from signature */
 141         while (signature.len && *(signature.ptr) == 0x00)
 142         {
 143                 signature.len -= 1;
 144                 signature.ptr++;
 145         }
 146
 147         if (signature.len > this->k)
 148         {
 149                 return INVALID_ARG;
 150         }
 151
 152         /* unpack signature */
 153         em_ori = em = rsavp1(this, signature);
 154
 155         /* result should look like this:
 156          * EM = 0x00 || 0x01 || PS || 0x00 || T.
 157          * PS = 0xFF padding, with length to fill em
 158          * T = oid || hash
 159          */
 160
 161         /* check magic bytes */
 162         if (*(em.ptr) != 0x00 || *(em.ptr+1) != 0x01)
 163         {
 164                 goto end;
 165         }
 166         em.ptr += 2;
 167         em.len -= 2;
 168
 169         /* find magic 0x00 */
 170         while (em.len > 0)
 171         {
 172                 if (*em.ptr == 0x00)
 173                 {
 174                         /* found magic byte, stop */
 175                         em.ptr++;
 176                         em.len--;
 177                         break;
 178                 }
 179                 else if (*em.ptr != 0xFF)
 180                 {
 181                         /* bad padding, decryption failed ?!*/
 182                         goto end;
 183                 }
 184                 em.ptr++;
 185                 em.len--;
 186         }
 187
 188         if (em.len == 0)
 189         {
 190                 /* no digestInfo found */
 191                 goto end;
 192         }
 193
 194         if (algorithm == HASH_UNKNOWN)
 195         {   /* IKEv1 signatures without digestInfo */
 196                 if (em.len != data.len)
 197                 {
 198                         DBG1("hash size in signature is %u bytes instead of %u bytes",
 199                                  em.len, data.len);
 200                         goto end;
 201                 }
 202                 success = memeq(em.ptr, data.ptr, data.len);
 203         }
 204         else
 205         {   /* IKEv2 and X.509 certificate signatures */
 206                 asn1_parser_t *parser;
 207                 chunk_t object;
 208                 int objectID;
 209                 hash_algorithm_t hash_algorithm = HASH_UNKNOWN;
 210
 211                 DBG2("signature verification:");
 212                 parser = asn1_parser_create(digestInfoObjects, em);
 213
 214                 while (parser->iterate(parser, &objectID, &object))
 215                 {
 216                         switch (objectID)
 217                         {
 218                                 case DIGEST_INFO:
 219                                 {
 220                                         if (em.len > object.len)
 221                                         {
 222                                                 DBG1("digestInfo field in signature is followed by %u surplus bytes",
 223                                                          em.len - object.len);
 224                                                 goto end_parser;
 225                                         }
 226                                         break;
 227                                 }
 228                                 case DIGEST_INFO_ALGORITHM:
 229                                 {
 230                                         int hash_oid = asn1_parse_algorithmIdentifier(object,
 231                                                                                  parser->get_level(parser)+1, NULL);
 232
 233                                         hash_algorithm = hasher_algorithm_from_oid(hash_oid);
 234                                         if (hash_algorithm == HASH_UNKNOWN || hash_algorithm != algorithm)
 235                                         {
 236                                                 DBG1("expected hash algorithm %N, but found %N (OID: %#B)",
 237                                                          hash_algorithm_names, algorithm,
 238                                                          hash_algorithm_names, hash_algorithm,  &object);
 239                                                 goto end_parser;
 240                                         }
 241                                         break;
 242                                 }
 243                                 case DIGEST_INFO_DIGEST:
 244                                 {
 245                                         chunk_t hash;
 246                                         hasher_t *hasher;
 247
 248                                         hasher = lib->crypto->create_hasher(lib->crypto, hash_algorithm);
 249                                         if (hasher == NULL)
 250                                         {
 251                                                 DBG1("hash algorithm %N not supported",
 252                                                          hash_algorithm_names, hash_algorithm);
 253                                                 goto end_parser;
 254                                         }
 255
 256                                         if (object.len != hasher->get_hash_size(hasher))
 257                                         {
 258                                                 DBG1("hash size in signature is %u bytes instead of %u "
 259                                                          "bytes", object.len, hasher->get_hash_size(hasher));
 260                                                 hasher->destroy(hasher);
 261                                                 goto end_parser;
 262                                         }
 263
 264                                         /* build our own hash and compare */
 265                                         hasher->allocate_hash(hasher, data, &hash);
 266                                         hasher->destroy(hasher);
 267                                         success = memeq(object.ptr, hash.ptr, hash.len);
 268                                         free(hash.ptr);
 269                                         break;
 270                                 }
 271                                 default:
 272                                         break;
 273                         }
 274                 }
 275
 276 end_parser:
 277                 success &= parser->success(parser);
 278                 parser->destroy(parser);
 279         }
 280
 281 end:
 282         free(em_ori.ptr);
 283         return success;
 284 }
 285
 286 /**
 287  * Implementation of public_key_t.get_type.
 288  */
 289 static key_type_t get_type(private_gmp_rsa_public_key_t *this)
 290 {
 291         return KEY_RSA;
 292 }
 293
 294 /**
 295  * Implementation of public_key_t.verify.
 296  */
 297 static bool verify(private_gmp_rsa_public_key_t *this, signature_scheme_t scheme,
 298                                    chunk_t data, chunk_t signature)
 299 {
 300         switch (scheme)
 301         {
 302                 case SIGN_DEFAULT:
 303                 case SIGN_RSA_EMSA_PKCS1_NULL:
 304                         return verify_emsa_pkcs1_signature(this, HASH_UNKNOWN, data, signature);
 305                 case SIGN_RSA_EMSA_PKCS1_MD5:
 306                         return verify_emsa_pkcs1_signature(this, HASH_MD5, data, signature);
 307                 case SIGN_RSA_EMSA_PKCS1_SHA1:
 308                         return verify_emsa_pkcs1_signature(this, HASH_SHA1, data, signature);
 309                 case SIGN_RSA_EMSA_PKCS1_SHA256:
 310                         return verify_emsa_pkcs1_signature(this, HASH_SHA256, data, signature);
 311                 case SIGN_RSA_EMSA_PKCS1_SHA384:
 312                         return verify_emsa_pkcs1_signature(this, HASH_SHA384, data, signature);
 313                 case SIGN_RSA_EMSA_PKCS1_SHA512:
 314                         return verify_emsa_pkcs1_signature(this, HASH_SHA512, data, signature);
 315                 default:
 316                         DBG1("signature scheme %N not supported in RSA",
 317                                  signature_scheme_names, scheme);
 318                         return FALSE;
 319         }
 320 }
 321
 322 /**
 323  * Implementation of public_key_t.get_keysize.
 324  */
 325 static bool encrypt_(private_gmp_rsa_public_key_t *this, chunk_t crypto, chunk_t *plain)
 326 {
 327         DBG1("RSA public key encryption not implemented");
 328         return FALSE;
 329 }
 330
 331 /**
 332  * Implementation of gmp_rsa_public_key.equals.
 333  */
 334 static bool equals(private_gmp_rsa_public_key_t *this, public_key_t *other)
 335 {
 336         identification_t *keyid;
 337
 338         if (&this->public.interface == other)
 339         {
 340                 return TRUE;
 341         }
 342         if (other->get_type(other) != KEY_RSA)
 343         {
 344                 return FALSE;
 345         }
 346         keyid = other->get_id(other, ID_PUBKEY_SHA1);
 347         if (keyid && keyid->equals(keyid, this->keyid))
 348         {
 349                 return TRUE;
 350         }
 351         keyid = other->get_id(other, ID_PUBKEY_INFO_SHA1);
 352         if (keyid && keyid->equals(keyid, this->keyid_info))
 353         {
 354                 return TRUE;
 355         }
 356         return FALSE;
 357 }
 358
 359 /**
 360  * Implementation of public_key_t.get_keysize.
 361  */
 362 static size_t get_keysize(private_gmp_rsa_public_key_t *this)
 363 {
 364         return this->k;
 365 }
 366
 367 /**
 368  * Build the PGP version 3 RSA key identifier from n and e using
 369  * MD5 hashed modulus and exponent. Also used in rsa_private_key.c.
 370  */
 371 static identification_t* gmp_rsa_build_pgp_v3_keyid(mpz_t n, mpz_t e)
 372 {
 373         identification_t *keyid;
 374         chunk_t modulus, mod, exponent, exp, hash;
 375         hasher_t *hasher;
 376
 377         hasher= lib->crypto->create_hasher(lib->crypto, HASH_MD5);
 378         if (hasher == NULL)
 379         {
 380                 DBG1("computation of PGP V3 keyid failed, no MD5 hasher is available");
 381                 return NULL;
 382         }
 383         mod = modulus  = gmp_mpz_to_chunk(n);
 384         exp = exponent = gmp_mpz_to_chunk(e);
 385
 386         /* remove leading zero bytes before hashing modulus and exponent */
 387         while (mod.len > 0 && *mod.ptr == 0x00)
 388         {
 389                 mod.ptr++;
 390                 mod.len--;
 391         }
 392         while (exp.len > 0 && *exp.ptr == 0x00)
 393         {
 394                 exp.ptr++;
 395                 exp.len--;
 396         }
 397         hasher->allocate_hash(hasher, mod, NULL);
 398         hasher->allocate_hash(hasher, exp, &hash);
 399         hasher->destroy(hasher);
 400         keyid = identification_create_from_encoding(ID_KEY_ID, hash);
 401         free(hash.ptr);
 402         free(modulus.ptr);
 403         free(exponent.ptr);
 404         return keyid;
 405 }
 406
 407 /**
 408  * Implementation of public_key_t.get_id.
 409  */
 410 static identification_t *get_id(private_gmp_rsa_public_key_t *this,
 411                                                                 id_type_t type)
 412 {
 413         switch (type)
 414         {
 415                 case ID_PUBKEY_INFO_SHA1:
 416                         return this->keyid_info;
 417                 case ID_PUBKEY_SHA1:
 418                         return this->keyid;
 419                 case ID_KEY_ID:
 420                         return gmp_rsa_build_pgp_v3_keyid(this->n, this->e);
 421                 default:
 422                         return NULL;
 423         }
 424 }
 425
 426 /*
 427  * Implementation of public_key_t.get_encoding.
 428  */
 429 static chunk_t get_encoding(private_gmp_rsa_public_key_t *this)
 430 {
 431         return asn1_wrap(ASN1_SEQUENCE, "mm",
 432                                          gmp_mpz_to_asn1(this->n),
 433                                          gmp_mpz_to_asn1(this->e));
 434 }
 435
 436 /**
 437  * Implementation of public_key_t.get_ref.
 438  */
 439 static private_gmp_rsa_public_key_t* get_ref(private_gmp_rsa_public_key_t *this)
 440 {
 441         ref_get(&this->ref);
 442         return this;
 443 }
 444
 445 /**
 446  * Implementation of gmp_rsa_public_key.destroy.
 447  */
 448 static void destroy(private_gmp_rsa_public_key_t *this)
 449 {
 450         if (ref_put(&this->ref))
 451         {
 452                 mpz_clear(this->n);
 453                 mpz_clear(this->e);
 454                 DESTROY_IF(this->keyid);
 455                 DESTROY_IF(this->keyid_info);
 456                 free(this);
 457         }
 458 }
 459
 460 /**
 461  * Generic private constructor
 462  */
 463 static private_gmp_rsa_public_key_t *gmp_rsa_public_key_create_empty()
 464 {
 465         private_gmp_rsa_public_key_t *this = malloc_thing(private_gmp_rsa_public_key_t);
 466
 467         this->public.interface.get_type = (key_type_t (*) (public_key_t*))get_type;
 468         this->public.interface.verify = (bool (*) (public_key_t*, signature_scheme_t, chunk_t, chunk_t))verify;
 469         this->public.interface.encrypt = (bool (*) (public_key_t*, chunk_t, chunk_t*))encrypt_;
 470         this->public.interface.equals = (bool (*) (public_key_t*, public_key_t*))equals;
 471         this->public.interface.get_keysize = (size_t (*) (public_key_t*))get_keysize;
 472         this->public.interface.get_id = (identification_t* (*) (public_key_t*, id_type_t))get_id;
 473         this->public.interface.get_encoding = (chunk_t(*) (public_key_t*))get_encoding;
 474         this->public.interface.get_ref = (public_key_t* (*) (public_key_t *this))get_ref;
 475         this->public.interface.destroy = (void (*) (public_key_t *this))destroy;
 476
 477         this->keyid = NULL;
 478         this->keyid_info = NULL;
 479         this->ref = 1;
 480
 481         return this;
 482 }
 483
 484 /**
 485  * Build the RSA key identifier from n and e using SHA1 hashed publicKey(Info).
 486  * Also used in rsa_private_key.c.
 487  */
 488 bool gmp_rsa_public_key_build_id(mpz_t n, mpz_t e, identification_t **keyid,
 489                                                                  identification_t **keyid_info)
 490 {
 491         chunk_t publicKeyInfo, publicKey, hash;
 492         hasher_t *hasher;
 493
 494         hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
 495         if (hasher == NULL)
 496         {
 497                 DBG1("SHA1 hash algorithm not supported, unable to use RSA");
 498                 return FALSE;
 499         }
 500         publicKey = asn1_wrap(ASN1_SEQUENCE, "mm",
 501                                         gmp_mpz_to_asn1(n),
 502                                         gmp_mpz_to_asn1(e));
 503         hasher->allocate_hash(hasher, publicKey, &hash);
 504         *keyid = identification_create_from_encoding(ID_PUBKEY_SHA1, hash);
 505         chunk_free(&hash);
 506
 507         publicKeyInfo = asn1_wrap(ASN1_SEQUENCE, "cm",
 508                                                 asn1_algorithmIdentifier(OID_RSA_ENCRYPTION),
 509                                                 asn1_bitstring("m", publicKey));
 510         hasher->allocate_hash(hasher, publicKeyInfo, &hash);
 511         *keyid_info = identification_create_from_encoding(ID_PUBKEY_INFO_SHA1, hash);
 512         chunk_free(&hash);
 513
 514         hasher->destroy(hasher);
 515         chunk_free(&publicKeyInfo);
 516
 517         return TRUE;
 518 }
 519
 520 /**
 521  * Create a public key from mpz values, used in gmp_rsa_private_key
 522  */
 523 gmp_rsa_public_key_t *gmp_rsa_public_key_create_from_n_e(mpz_t n, mpz_t e)
 524 {
 525         private_gmp_rsa_public_key_t *this = gmp_rsa_public_key_create_empty();
 526
 527         mpz_init_set(this->n, n);
 528         mpz_init_set(this->e, e);
 529
 530         this->k = (mpz_sizeinbase(this->n, 2) + 7) /  BITS_PER_BYTE;
 531         if (!gmp_rsa_public_key_build_id(this->n, this->e,
 532                                                                          &this->keyid, &this->keyid_info))
 533         {
 534                 destroy(this);
 535                 return NULL;
 536         }
 537         return &this->public;
 538 }
 539
 540 /**
 541  * ASN.1 definition of RSApublicKey
 542  */
 543 static const asn1Object_t pubkeyObjects[] = {
 544         { 0, "RSAPublicKey",            ASN1_SEQUENCE,  ASN1_OBJ  }, /*  0 */
 545         { 1,   "modulus",                       ASN1_INTEGER,   ASN1_BODY }, /*  1 */
 546         { 1,   "publicExponent",        ASN1_INTEGER,   ASN1_BODY }, /*  2 */
 547         { 0, "exit",                            ASN1_EOC,               ASN1_EXIT }
 548 };
 549 #define PUB_KEY_RSA_PUBLIC_KEY          0
 550 #define PUB_KEY_MODULUS                         1
 551 #define PUB_KEY_EXPONENT                        2
 552
 553 /**
 554  * Load a public key from an ASN.1 encoded blob
 555  */
 556 static gmp_rsa_public_key_t *load_asn1_der(chunk_t blob)
 557 {
 558         asn1_parser_t *parser;
 559         chunk_t object;
 560         int objectID;
 561         bool success = FALSE;
 562
 563         private_gmp_rsa_public_key_t *this = gmp_rsa_public_key_create_empty();
 564
 565         mpz_init(this->n);
 566         mpz_init(this->e);
 567
 568         parser = asn1_parser_create(pubkeyObjects, blob);
 569
 570         while (parser->iterate(parser, &objectID, &object))
 571         {
 572                 switch (objectID)
 573                 {
 574                         case PUB_KEY_MODULUS:
 575                                 mpz_import(this->n, object.len, 1, 1, 1, 0, object.ptr);
 576                                 break;
 577                         case PUB_KEY_EXPONENT:
 578                                 mpz_import(this->e, object.len, 1, 1, 1, 0, object.ptr);
 579                                 break;
 580                 }
 581         }
 582         success = parser->success(parser);
 583         free(blob.ptr);
 584         parser->destroy(parser);
 585
 586         if (!success)
 587         {
 588                 destroy(this);
 589                 return NULL;
 590         }
 591
 592         this->k = (mpz_sizeinbase(this->n, 2) + 7) /  BITS_PER_BYTE;
 593
 594         if (!gmp_rsa_public_key_build_id(this->n, this->e,
 595                                                                          &this->keyid, &this->keyid_info))
 596         {
 597                 destroy(this);
 598                 return NULL;
 599         }
 600         return &this->public;
 601 }
 602
 603 /**
 604  * Load a public key from an OpenPGP blob
 605  */
 606 static gmp_rsa_public_key_t* load_pgp(chunk_t blob)
 607 {
 608         int objectID;
 609         chunk_t packet = blob;
 610         private_gmp_rsa_public_key_t *this = gmp_rsa_public_key_create_empty();
 611
 612         mpz_init(this->n);
 613         mpz_init(this->e);
 614
 615         for (objectID = PUB_KEY_MODULUS; objectID <= PUB_KEY_EXPONENT; objectID++)
 616         {
 617                 chunk_t object;
 618
 619                 DBG2("L3 - %s:", pubkeyObjects[objectID].name);
 620                 object.len = pgp_length(&packet, 2);
 621
 622                 if (object.len == PGP_INVALID_LENGTH)
 623                 {
 624                         DBG1("OpenPGP length is invalid");
 625                         goto end;
 626                 }
 627                 object.len = (object.len + 7) / BITS_PER_BYTE;
 628                 if (object.len > packet.len)
 629                 {
 630                         DBG1("OpenPGP field is too short");
 631                         goto end;
 632                 }
 633                 object.ptr = packet.ptr;
 634                 packet.ptr += object.len;
 635                 packet.len -= object.len;
 636                 DBG4("%B", &object);
 637
 638                 switch (objectID)
 639                 {
 640                         case PUB_KEY_MODULUS:
 641                                 mpz_import(this->n, object.len, 1, 1, 1, 0, object.ptr);
 642                                 break;
 643                         case PUB_KEY_EXPONENT:
 644                                 mpz_import(this->e, object.len, 1, 1, 1, 0, object.ptr);
 645                                 break;
 646                 }
 647         }
 648
 649         this->k = (mpz_sizeinbase(this->n, 2) + 7) /  BITS_PER_BYTE;
 650         free(blob.ptr);
 651
 652         if (!gmp_rsa_public_key_build_id(this->n, this->e,
 653                                                                          &this->keyid, &this->keyid_info))
 654         {
 655                 destroy(this);
 656                 return NULL;
 657         }
 658         return &this->public;
 659
 660 end:
 661         free(blob.ptr);
 662         destroy(this);
 663         return NULL;
 664 }
 665
 666 /**
 667  * Load a public key from an RFC 3110 encoded blob
 668  */
 669 static gmp_rsa_public_key_t *load_rfc_3110(chunk_t blob)
 670 {
 671         chunk_t exponent, modulus;
 672         u_char *pos = blob.ptr;
 673         size_t len  = blob.len;
 674         private_gmp_rsa_public_key_t *this = gmp_rsa_public_key_create_empty();
 675
 676         mpz_init(this->n);
 677         mpz_init(this->e);
 678
 679         if (blob.len < 3)
 680         {
 681                 DBG1("RFC 3110 public key blob too short for exponent length");
 682                 goto end;
 683         }
 684         if (pos[0] != 0x00)
 685         {
 686                 exponent = chunk_create(pos + 1, pos[0]);
 687                 pos++;
 688                 len--;
 689         }
 690         else
 691         {
 692                 exponent = chunk_create(pos + 3, 256*pos[1] + pos[2]);
 693                 pos += 3;
 694                 len -= 3;
 695         }
 696         if (exponent.len > len)
 697         {
 698                 DBG1("RFC 3110 public key blob too short for exponent");
 699                 goto end;
 700         }
 701         pos += exponent.len;
 702         len -= exponent.len;
 703
 704         if (len == 0)
 705         {
 706                 DBG1("RFC 3110 public key blob has zero length modulus");
 707                 goto end;
 708         }
 709         modulus = chunk_create(pos, len);
 710
 711         mpz_import(this->n, modulus.len,  1, 1, 1, 0, modulus.ptr);
 712         mpz_import(this->e, exponent.len, 1, 1, 1, 0, exponent.ptr);
 713         this->k = (mpz_sizeinbase(this->n, 2) + 7) /  BITS_PER_BYTE;
 714         free(blob.ptr);
 715
 716         if (!gmp_rsa_public_key_build_id(this->n, this->e,
 717                                                                          &this->keyid, &this->keyid_info))
 718         {
 719                 destroy(this);
 720                 return NULL;
 721         }
 722         return &this->public;
 723
 724 end:
 725         free(blob.ptr);
 726         destroy(this);
 727         return NULL;
 728 }
 729
 730 typedef struct private_builder_t private_builder_t;
 731 /**
 732  * Builder implementation for key loading
 733  */
 734 struct private_builder_t {
 735         /** implements the builder interface */
 736         builder_t public;
 737         /** loaded public key */
 738         gmp_rsa_public_key_t *key;
 739 };
 740
 741 /**
 742  * Implementation of builder_t.build
 743  */
 744 static gmp_rsa_public_key_t *build(private_builder_t *this)
 745 {
 746         gmp_rsa_public_key_t *key = this->key;
 747
 748         free(this);
 749         return key;
 750 }
 751
 752 /**
 753  * Implementation of builder_t.add
 754  */
 755 static void add(private_builder_t *this, builder_part_t part, ...)
 756 {
 757         if (!this->key)
 758         {
 759                 va_list args;
 760                 chunk_t chunk;
 761
 762                 switch (part)
 763                 {
 764                         case BUILD_BLOB_ASN1_DER:
 765                         {
 766                                 va_start(args, part);
 767                                 chunk = va_arg(args, chunk_t);
 768                                 this->key = load_asn1_der(chunk_clone(chunk));
 769                                 va_end(args);
 770                                 return;
 771                         }
 772                         case BUILD_BLOB_PGP:
 773                         {
 774                                 va_start(args, part);
 775                                 chunk = va_arg(args, chunk_t);
 776                                 this->key = load_pgp(chunk_clone(chunk));
 777                                 va_end(args);
 778                                 return;
 779                         }
 780                         case BUILD_BLOB_RFC_3110:
 781                         {
 782                                 va_start(args, part);
 783                                 chunk = va_arg(args, chunk_t);
 784                                 this->key = load_rfc_3110(chunk_clone(chunk));
 785                                 va_end(args);
 786                                 return;
 787                         }
 788                         default:
 789                                 break;
 790                 }
 791         }
 792         if (this->key)
 793         {
 794                 destroy((private_gmp_rsa_public_key_t*)this->key);
 795         }
 796         builder_cancel(&this->public);
 797 }
 798
 799 /**
 800  * Builder construction function
 801  */
 802 builder_t *gmp_rsa_public_key_builder(key_type_t type)
 803 {
 804         private_builder_t *this;
 805
 806         if (type != KEY_RSA)
 807         {
 808                 return NULL;
 809         }
 810
 811         this = malloc_thing(private_builder_t);
 812
 813         this->key = NULL;
 814         this->public.add = (void(*)(builder_t *this, builder_part_t part, ...))add;
 815         this->public.build = (void*(*)(builder_t *this))build;
 816
 817         return &this->public;
 818 }
 819