18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RSA 350b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "asn1.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "bignum.h" 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "rsa.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct crypto_rsa_key { 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int private_key; /* whether private key is set */ 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *n; /* modulus (p * q) */ 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *e; /* public exponent */ 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* The following parameters are available only if private_key is set */ 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *d; /* private exponent */ 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *p; /* prime p (factor of n) */ 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *q; /* prime q (factor of n) */ 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *dmp1; /* d mod (p - 1); CRT exponent */ 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *dmq1; /* d mod (q - 1); CRT exponent */ 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *iqmp; /* 1 / q mod p; CRT coefficient */ 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}; 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const u8 * crypto_rsa_parse_integer(const u8 *pos, const u8 *end, 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *num) 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct asn1_hdr hdr; 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (asn1_get_next(pos, end - pos, &hdr) < 0 || 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.class != ASN1_CLASS_UNIVERSAL || hdr.tag != ASN1_TAG_INTEGER) { 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "RSA: Expected INTEGER - found class %d " 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "tag 0x%x", hdr.class, hdr.tag); 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_set_unsigned_bin(num, hdr.payload, hdr.length) < 0) { 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "RSA: Failed to parse INTEGER"); 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return hdr.payload + hdr.length; 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_import_public_key - Import an RSA public key 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @buf: Key buffer (DER encoded RSA public key) 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @len: Key buffer length in bytes 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: Pointer to the public key or %NULL on failure 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct crypto_rsa_key * 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtcrypto_rsa_import_public_key(const u8 *buf, size_t len) 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct crypto_rsa_key *key; 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct asn1_hdr hdr; 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos, *end; 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_zalloc(sizeof(*key)); 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key == NULL) 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->n = bignum_init(); 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->e = bignum_init(); 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key->n == NULL || key->e == NULL) { 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_rsa_free(key); 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * PKCS #1, 7.1: 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RSAPublicKey ::= SEQUENCE { 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * modulus INTEGER, -- n 83293335998d38c497293b1c41f7ad8342b507d458Dmitry Shmidt * publicExponent INTEGER -- e 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * } 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (asn1_get_next(buf, len, &hdr) < 0 || 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.class != ASN1_CLASS_UNIVERSAL || 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.tag != ASN1_TAG_SEQUENCE) { 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "RSA: Expected SEQUENCE " 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(public key) - found class %d tag 0x%x", 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.class, hdr.tag); 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = hdr.payload; 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = pos + hdr.length; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->n); 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->e); 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos != end) { 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_DEBUG, 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "RSA: Extra data in public key SEQUENCE", 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, end - pos); 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidterror: 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_rsa_free(key); 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 11950b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidtstruct crypto_rsa_key * 12050b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidtcrypto_rsa_import_public_key_parts(const u8 *n, size_t n_len, 12150b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt const u8 *e, size_t e_len) 12250b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt{ 12350b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt struct crypto_rsa_key *key; 12450b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt 12550b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt key = os_zalloc(sizeof(*key)); 12650b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt if (key == NULL) 12750b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt return NULL; 12850b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt 12950b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt key->n = bignum_init(); 13050b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt key->e = bignum_init(); 13150b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt if (key->n == NULL || key->e == NULL || 13250b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt bignum_set_unsigned_bin(key->n, n, n_len) < 0 || 13350b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt bignum_set_unsigned_bin(key->e, e, e_len) < 0) { 13450b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt crypto_rsa_free(key); 13550b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt return NULL; 13650b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt } 13750b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt 13850b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt return key; 13950b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt} 14050b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt 14150b691dc36a8075e8f594e8bea93cb524fa6b1d2Dmitry Shmidt 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_import_private_key - Import an RSA private key 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @buf: Key buffer (DER encoded RSA private key) 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @len: Key buffer length in bytes 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: Pointer to the private key or %NULL on failure 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct crypto_rsa_key * 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtcrypto_rsa_import_private_key(const u8 *buf, size_t len) 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct crypto_rsa_key *key; 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *zero; 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct asn1_hdr hdr; 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos, *end; 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_zalloc(sizeof(*key)); 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key == NULL) 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->private_key = 1; 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->n = bignum_init(); 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->e = bignum_init(); 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->d = bignum_init(); 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->p = bignum_init(); 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->q = bignum_init(); 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->dmp1 = bignum_init(); 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->dmq1 = bignum_init(); 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->iqmp = bignum_init(); 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key->n == NULL || key->e == NULL || key->d == NULL || 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->p == NULL || key->q == NULL || key->dmp1 == NULL || 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key->dmq1 == NULL || key->iqmp == NULL) { 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_rsa_free(key); 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * PKCS #1, 7.2: 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RSAPrivateKey ::= SEQUENCE { 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * version Version, 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * modulus INTEGER, -- n 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * publicExponent INTEGER, -- e 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * privateExponent INTEGER, -- d 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * prime1 INTEGER, -- p 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * prime2 INTEGER, -- q 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * exponent1 INTEGER, -- d mod (p-1) 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * exponent2 INTEGER, -- d mod (q-1) 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * coefficient INTEGER -- (inverse of q) mod p 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * } 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Version ::= INTEGER -- shall be 0 for this version of the standard 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (asn1_get_next(buf, len, &hdr) < 0 || 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.class != ASN1_CLASS_UNIVERSAL || 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.tag != ASN1_TAG_SEQUENCE) { 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "RSA: Expected SEQUENCE " 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(public key) - found class %d tag 0x%x", 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hdr.class, hdr.tag); 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = hdr.payload; 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = pos + hdr.length; 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt zero = bignum_init(); 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (zero == NULL) 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, zero); 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL || bignum_cmp_d(zero, 0) != 0) { 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "RSA: Expected zero INTEGER in the " 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "beginning of private key; not found"); 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(zero); 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(zero); 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->n); 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->e); 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->d); 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->p); 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->q); 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->dmp1); 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->dmq1); 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = crypto_rsa_parse_integer(pos, end, key->iqmp); 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos != end) { 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_DEBUG, 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "RSA: Extra data in public key SEQUENCE", 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, end - pos); 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidterror: 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_rsa_free(key); 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_get_modulus_len - Get the modulus length of the RSA key 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @key: RSA key 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: Modulus length of the key 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtsize_t crypto_rsa_get_modulus_len(struct crypto_rsa_key *key) 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return bignum_get_unsigned_bin_len(key->n); 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_exptmod - RSA modular exponentiation 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @in: Input data 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @inlen: Input data length 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @out: Buffer for output data 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @outlen: Maximum size of the output buffer and used size on success 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @key: RSA key 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @use_private: 1 = Use RSA private key, 0 = Use RSA public key 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: 0 on success, -1 on failure 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint crypto_rsa_exptmod(const u8 *in, size_t inlen, u8 *out, size_t *outlen, 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct crypto_rsa_key *key, int use_private) 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct bignum *tmp, *a = NULL, *b = NULL; 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int ret = -1; 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t modlen; 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (use_private && !key->private_key) 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tmp = bignum_init(); 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tmp == NULL) 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_set_unsigned_bin(tmp, in, inlen) < 0) 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_cmp(key->n, tmp) < 0) { 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Too large input value for the RSA key modulus */ 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (use_private) { 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Decrypt (or sign) using Chinese remainer theorem to speed 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * up calculation. This is equivalent to tmp = tmp^d mod n 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * (which would require more CPU to calculate directly). 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * dmp1 = (1/e) mod (p-1) 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * dmq1 = (1/e) mod (q-1) 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * iqmp = (1/q) mod p, where p > q 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * m1 = c^dmp1 mod p 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * m2 = c^dmq1 mod q 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * h = q^-1 (m1 - m2) mod p 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * m = m2 + hq 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt a = bignum_init(); 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt b = bignum_init(); 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (a == NULL || b == NULL) 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* a = tmp^dmp1 mod p */ 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_exptmod(tmp, key->dmp1, key->p, a) < 0) 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* b = tmp^dmq1 mod q */ 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_exptmod(tmp, key->dmq1, key->q, b) < 0) 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* tmp = (a - b) * (1/q mod p) (mod p) */ 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_sub(a, b, tmp) < 0 || 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_mulmod(tmp, key->iqmp, key->p, tmp) < 0) 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* tmp = b + q * tmp */ 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_mul(tmp, key->q, tmp) < 0 || 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_add(tmp, b, tmp) < 0) 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Encrypt (or verify signature) */ 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* tmp = tmp^e mod N */ 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_exptmod(tmp, key->e, key->n, tmp) < 0) 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt modlen = crypto_rsa_get_modulus_len(key); 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (modlen > *outlen) { 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *outlen = modlen; 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_get_unsigned_bin_len(tmp) > modlen) 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; /* should never happen */ 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *outlen = modlen; 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(out, 0, modlen); 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (bignum_get_unsigned_bin( 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tmp, out + 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (modlen - bignum_get_unsigned_bin_len(tmp)), NULL) < 0) 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto error; 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret = 0; 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidterror: 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(tmp); 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(a); 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(b); 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return ret; 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_free - Free RSA key 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @key: RSA key to be freed 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function frees an RSA key imported with either 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * crypto_rsa_import_public_key() or crypto_rsa_import_private_key(). 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid crypto_rsa_free(struct crypto_rsa_key *key) 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->n); 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->e); 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->d); 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->p); 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->q); 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->dmp1); 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->dmq1); 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt bignum_deinit(key->iqmp); 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(key); 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 376