use super::PUBLIC_KEY_PUBLIC_MODULUS_MAX_LEN;
use crate::{bits, digest, error, io::der};
use untrusted;
#[cfg(feature = "alloc")]
use crate::rand;
pub trait Padding: 'static + Sync + crate::sealed::Sealed + core::fmt::Debug {
fn digest_alg(&self) -> &'static digest::Algorithm;
}
#[cfg(feature = "alloc")]
pub trait RsaEncoding: Padding {
#[doc(hidden)]
fn encode(
&self,
m_hash: &digest::Digest,
m_out: &mut [u8],
mod_bits: bits::BitLength,
rng: &dyn rand::SecureRandom,
) -> Result<(), error::Unspecified>;
}
pub trait Verification: Padding {
fn verify(
&self,
m_hash: &digest::Digest,
m: &mut untrusted::Reader,
mod_bits: bits::BitLength,
) -> Result<(), error::Unspecified>;
}
#[derive(Debug)]
pub struct PKCS1 {
digest_alg: &'static digest::Algorithm,
digestinfo_prefix: &'static [u8],
}
impl crate::sealed::Sealed for PKCS1 {}
impl Padding for PKCS1 {
fn digest_alg(&self) -> &'static digest::Algorithm {
self.digest_alg
}
}
#[cfg(feature = "alloc")]
impl RsaEncoding for PKCS1 {
fn encode(
&self,
m_hash: &digest::Digest,
m_out: &mut [u8],
_mod_bits: bits::BitLength,
_rng: &dyn rand::SecureRandom,
) -> Result<(), error::Unspecified> {
pkcs1_encode(&self, m_hash, m_out);
Ok(())
}
}
impl Verification for PKCS1 {
fn verify(
&self,
m_hash: &digest::Digest,
m: &mut untrusted::Reader,
mod_bits: bits::BitLength,
) -> Result<(), error::Unspecified> {
let mut calculated = [0u8; PUBLIC_KEY_PUBLIC_MODULUS_MAX_LEN];
let calculated = &mut calculated[..mod_bits.as_usize_bytes_rounded_up()];
pkcs1_encode(&self, m_hash, calculated);
if m.read_bytes_to_end() != *calculated.as_ref() {
return Err(error::Unspecified);
}
Ok(())
}
}
fn pkcs1_encode(pkcs1: &PKCS1, m_hash: &digest::Digest, m_out: &mut [u8]) {
let em = m_out;
let digest_len = pkcs1.digestinfo_prefix.len() + pkcs1.digest_alg.output_len;
assert!(em.len() >= digest_len + 11);
let pad_len = em.len() - digest_len - 3;
em[0] = 0;
em[1] = 1;
for i in 0..pad_len {
em[2 + i] = 0xff;
}
em[2 + pad_len] = 0;
let (digest_prefix, digest_dst) = em[3 + pad_len..].split_at_mut(pkcs1.digestinfo_prefix.len());
digest_prefix.copy_from_slice(pkcs1.digestinfo_prefix);
digest_dst.copy_from_slice(m_hash.as_ref());
}
macro_rules! rsa_pkcs1_padding {
( $PADDING_ALGORITHM:ident, $digest_alg:expr, $digestinfo_prefix:expr,
$doc_str:expr ) => {
#[doc=$doc_str]
pub static $PADDING_ALGORITHM: PKCS1 = PKCS1 {
digest_alg: $digest_alg,
digestinfo_prefix: $digestinfo_prefix,
};
};
}
rsa_pkcs1_padding!(
RSA_PKCS1_SHA1_FOR_LEGACY_USE_ONLY,
&digest::SHA1_FOR_LEGACY_USE_ONLY,
&SHA1_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-1 for RSA signatures."
);
rsa_pkcs1_padding!(
RSA_PKCS1_SHA256,
&digest::SHA256,
&SHA256_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-256 for RSA signatures."
);
rsa_pkcs1_padding!(
RSA_PKCS1_SHA384,
&digest::SHA384,
&SHA384_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-384 for RSA signatures."
);
rsa_pkcs1_padding!(
RSA_PKCS1_SHA512,
&digest::SHA512,
&SHA512_PKCS1_DIGESTINFO_PREFIX,
"PKCS#1 1.5 padding using SHA-512 for RSA signatures."
);
macro_rules! pkcs1_digestinfo_prefix {
( $name:ident, $digest_len:expr, $digest_oid_len:expr,
[ $( $digest_oid:expr ),* ] ) => {
static $name: [u8; 2 + 8 + $digest_oid_len] = [
der::Tag::Sequence as u8, 8 + $digest_oid_len + $digest_len,
der::Tag::Sequence as u8, 2 + $digest_oid_len + 2,
der::Tag::OID as u8, $digest_oid_len, $( $digest_oid ),*,
der::Tag::Null as u8, 0,
der::Tag::OctetString as u8, $digest_len,
];
}
}
pkcs1_digestinfo_prefix!(
SHA1_PKCS1_DIGESTINFO_PREFIX,
20,
5,
[0x2b, 0x0e, 0x03, 0x02, 0x1a]
);
pkcs1_digestinfo_prefix!(
SHA256_PKCS1_DIGESTINFO_PREFIX,
32,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01]
);
pkcs1_digestinfo_prefix!(
SHA384_PKCS1_DIGESTINFO_PREFIX,
48,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02]
);
pkcs1_digestinfo_prefix!(
SHA512_PKCS1_DIGESTINFO_PREFIX,
64,
9,
[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03]
);
#[derive(Debug)]
pub struct PSS {
digest_alg: &'static digest::Algorithm,
}
impl crate::sealed::Sealed for PSS {}
const MAX_SALT_LEN: usize = digest::MAX_OUTPUT_LEN;
impl Padding for PSS {
fn digest_alg(&self) -> &'static digest::Algorithm {
self.digest_alg
}
}
impl RsaEncoding for PSS {
fn encode(
&self,
m_hash: &digest::Digest,
m_out: &mut [u8],
mod_bits: bits::BitLength,
rng: &dyn rand::SecureRandom,
) -> Result<(), error::Unspecified> {
let metrics = PSSMetrics::new(self.digest_alg, mod_bits)?;
let em = if metrics.top_byte_mask == 0xff {
m_out[0] = 0;
&mut m_out[1..]
} else {
m_out
};
assert_eq!(em.len(), metrics.em_len);
let mut salt = [0u8; MAX_SALT_LEN];
let salt = &mut salt[..metrics.s_len];
rng.fill(salt)?;
let h_hash = pss_digest(self.digest_alg, m_hash, salt);
let (mut masked_db, digest_terminator) = em.split_at_mut(metrics.db_len);
mgf1(self.digest_alg, h_hash.as_ref(), &mut masked_db)?;
{
let masked_db = masked_db.into_iter();
let mut masked_db = masked_db.skip(metrics.ps_len);
*(masked_db.next().ok_or(error::Unspecified)?) ^= 0x01;
for (masked_db_b, salt_b) in masked_db.zip(salt) {
*masked_db_b ^= *salt_b;
}
}
masked_db[0] &= metrics.top_byte_mask;
digest_terminator[..metrics.h_len].copy_from_slice(h_hash.as_ref());
digest_terminator[metrics.h_len] = 0xbc;
Ok(())
}
}
impl Verification for PSS {
fn verify(
&self,
m_hash: &digest::Digest,
m: &mut untrusted::Reader,
mod_bits: bits::BitLength,
) -> Result<(), error::Unspecified> {
let metrics = PSSMetrics::new(self.digest_alg, mod_bits)?;
if metrics.top_byte_mask == 0xff {
if m.read_byte()? != 0 {
return Err(error::Unspecified);
}
};
let em = m;
let masked_db = em.read_bytes(metrics.db_len)?;
let h_hash = em.read_bytes(metrics.h_len)?;
if em.read_byte()? != 0xbc {
return Err(error::Unspecified);
}
let mut db = [0u8; PUBLIC_KEY_PUBLIC_MODULUS_MAX_LEN];
let db = &mut db[..metrics.db_len];
mgf1(self.digest_alg, h_hash.as_slice_less_safe(), db)?;
masked_db.read_all(error::Unspecified, |masked_bytes| {
let b = masked_bytes.read_byte()?;
if b & !metrics.top_byte_mask != 0 {
return Err(error::Unspecified);
}
db[0] ^= b;
for i in 1..db.len() {
db[i] ^= masked_bytes.read_byte()?;
}
Ok(())
})?;
db[0] &= metrics.top_byte_mask;
let ps_len = metrics.ps_len;
for i in 0..ps_len {
if db[i] != 0 {
return Err(error::Unspecified);
}
}
if db[metrics.ps_len] != 1 {
return Err(error::Unspecified);
}
let salt = &db[(db.len() - metrics.s_len)..];
let h_prime = pss_digest(self.digest_alg, m_hash, salt);
if h_hash != *h_prime.as_ref() {
return Err(error::Unspecified);
}
Ok(())
}
}
struct PSSMetrics {
#[cfg_attr(not(feature = "alloc"), allow(dead_code))]
em_len: usize,
db_len: usize,
ps_len: usize,
s_len: usize,
h_len: usize,
top_byte_mask: u8,
}
impl PSSMetrics {
fn new(
digest_alg: &'static digest::Algorithm,
mod_bits: bits::BitLength,
) -> Result<PSSMetrics, error::Unspecified> {
let em_bits = mod_bits.try_sub_1()?;
let em_len = em_bits.as_usize_bytes_rounded_up();
let leading_zero_bits = (8 * em_len) - em_bits.as_usize_bits();
debug_assert!(leading_zero_bits < 8);
let top_byte_mask = 0xffu8 >> leading_zero_bits;
let h_len = digest_alg.output_len;
let s_len = h_len;
let db_len = em_len.checked_sub(1 + s_len).ok_or(error::Unspecified)?;
let ps_len = db_len.checked_sub(h_len + 1).ok_or(error::Unspecified)?;
debug_assert!(em_bits.as_usize_bits() >= (8 * h_len) + (8 * s_len) + 9);
Ok(PSSMetrics {
em_len,
db_len,
ps_len,
s_len,
h_len,
top_byte_mask,
})
}
}
fn mgf1(
digest_alg: &'static digest::Algorithm,
seed: &[u8],
mask: &mut [u8],
) -> Result<(), error::Unspecified> {
let digest_len = digest_alg.output_len;
let ctr_max = (mask.len() - 1) / digest_len;
assert!(ctr_max <= u32::max_value() as usize);
for (i, mask_chunk) in mask.chunks_mut(digest_len).enumerate() {
let mut ctx = digest::Context::new(digest_alg);
ctx.update(seed);
ctx.update(&u32::to_be_bytes(i as u32));
let digest = ctx.finish();
let mask_chunk_len = mask_chunk.len();
mask_chunk.copy_from_slice(&digest.as_ref()[..mask_chunk_len]);
}
Ok(())
}
fn pss_digest(
digest_alg: &'static digest::Algorithm,
m_hash: &digest::Digest,
salt: &[u8],
) -> digest::Digest {
const PREFIX_ZEROS: [u8; 8] = [0u8; 8];
let mut ctx = digest::Context::new(digest_alg);
ctx.update(&PREFIX_ZEROS);
ctx.update(m_hash.as_ref());
ctx.update(salt);
ctx.finish()
}
macro_rules! rsa_pss_padding {
( $PADDING_ALGORITHM:ident, $digest_alg:expr, $doc_str:expr ) => {
#[doc=$doc_str]
pub static $PADDING_ALGORITHM: PSS = PSS {
digest_alg: $digest_alg,
};
};
}
rsa_pss_padding!(
RSA_PSS_SHA256,
&digest::SHA256,
"RSA PSS padding using SHA-256 for RSA signatures.\n\nSee
\"`RSA_PSS_*` Details\" in `ring::signature`'s module-level
documentation for more details."
);
rsa_pss_padding!(
RSA_PSS_SHA384,
&digest::SHA384,
"RSA PSS padding using SHA-384 for RSA signatures.\n\nSee
\"`RSA_PSS_*` Details\" in `ring::signature`'s module-level
documentation for more details."
);
rsa_pss_padding!(
RSA_PSS_SHA512,
&digest::SHA512,
"RSA PSS padding using SHA-512 for RSA signatures.\n\nSee
\"`RSA_PSS_*` Details\" in `ring::signature`'s module-level
documentation for more details."
);
#[cfg(test)]
mod test {
use super::*;
use crate::{digest, error, test};
use alloc::vec;
use untrusted;
#[test]
fn test_pss_padding_verify() {
test::run(
test_file!("rsa_pss_padding_tests.txt"),
|section, test_case| {
assert_eq!(section, "");
let digest_name = test_case.consume_string("Digest");
let alg = match digest_name.as_ref() {
"SHA256" => &RSA_PSS_SHA256,
"SHA384" => &RSA_PSS_SHA384,
"SHA512" => &RSA_PSS_SHA512,
_ => panic!("Unsupported digest: {}", digest_name),
};
let msg = test_case.consume_bytes("Msg");
let msg = untrusted::Input::from(&msg);
let m_hash = digest::digest(alg.digest_alg(), msg.as_slice_less_safe());
let encoded = test_case.consume_bytes("EM");
let encoded = untrusted::Input::from(&encoded);
let _ = test_case.consume_bytes("Salt");
let bit_len = test_case.consume_usize_bits("Len");
let is_valid = test_case.consume_string("Result") == "P";
let actual_result =
encoded.read_all(error::Unspecified, |m| alg.verify(&m_hash, m, bit_len));
assert_eq!(actual_result.is_ok(), is_valid);
Ok(())
},
);
}
#[cfg(feature = "alloc")]
#[test]
fn test_pss_padding_encode() {
test::run(
test_file!("rsa_pss_padding_tests.txt"),
|section, test_case| {
assert_eq!(section, "");
let digest_name = test_case.consume_string("Digest");
let alg = match digest_name.as_ref() {
"SHA256" => &RSA_PSS_SHA256,
"SHA384" => &RSA_PSS_SHA384,
"SHA512" => &RSA_PSS_SHA512,
_ => panic!("Unsupported digest: {}", digest_name),
};
let msg = test_case.consume_bytes("Msg");
let salt = test_case.consume_bytes("Salt");
let encoded = test_case.consume_bytes("EM");
let bit_len = test_case.consume_usize_bits("Len");
let expected_result = test_case.consume_string("Result");
if expected_result != "P" {
return Ok(());
}
let rng = test::rand::FixedSliceRandom { bytes: &salt };
let mut m_out = vec![0u8; bit_len.as_usize_bytes_rounded_up()];
let digest = digest::digest(alg.digest_alg(), &msg);
alg.encode(&digest, &mut m_out, bit_len, &rng).unwrap();
assert_eq!(m_out, encoded);
Ok(())
},
);
}
}