ring/rsa/
padding.rs

Help
1// Copyright 2015-2016 Brian Smith.
2//
3// Permission to use, copy, modify, and/or distribute this software for any
4// purpose with or without fee is hereby granted, provided that the above
5// copyright notice and this permission notice appear in all copies.
6//
7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14
15use crate::{bb, bits, digest, error, rand};
16
17mod pkcs1;
18mod pss;
19
20pub use self::{
21    pkcs1::{RSA_PKCS1_SHA256, RSA_PKCS1_SHA384, RSA_PKCS1_SHA512},
22    pss::{RSA_PSS_SHA256, RSA_PSS_SHA384, RSA_PSS_SHA512},
23};
24pub(super) use pkcs1::RSA_PKCS1_SHA1_FOR_LEGACY_USE_ONLY;
25
26/// Common features of both RSA padding encoding and RSA padding verification.
27pub trait Padding: 'static + Sync + crate::sealed::Sealed + core::fmt::Debug {
28    // The digest algorithm used for digesting the message (and maybe for
29    // other things).
30    fn digest_alg(&self) -> &'static digest::Algorithm;
31}
32
33/// An RSA signature encoding as described in [RFC 3447 Section 8].
34///
35/// [RFC 3447 Section 8]: https://tools.ietf.org/html/rfc3447#section-8
36#[cfg(feature = "alloc")]
37pub trait RsaEncoding: Padding {
38    #[doc(hidden)]
39    fn encode(
40        &self,
41        m_hash: digest::Digest,
42        m_out: &mut [u8],
43        mod_bits: bits::BitLength,
44        rng: &dyn rand::SecureRandom,
45    ) -> Result<(), error::Unspecified>;
46}
47
48/// Verification of an RSA signature encoding as described in
49/// [RFC 3447 Section 8].
50///
51/// [RFC 3447 Section 8]: https://tools.ietf.org/html/rfc3447#section-8
52pub trait Verification: Padding {
53    fn verify(
54        &self,
55        m_hash: digest::Digest,
56        m: &mut untrusted::Reader,
57        mod_bits: bits::BitLength,
58    ) -> Result<(), error::Unspecified>;
59}
60
61// Masks `out` with the output of the mask-generating function MGF1 as
62// described in https://tools.ietf.org/html/rfc3447#appendix-B.2.1.
63fn mgf1(digest_alg: &'static digest::Algorithm, seed: &[u8], out: &mut [u8]) {
64    let digest_len = digest_alg.output_len();
65
66    // Maximum counter value is the value of (mask_len / digest_len) rounded up.
67    for (i, out) in out.chunks_mut(digest_len).enumerate() {
68        let mut ctx = digest::Context::new(digest_alg);
69        ctx.update(seed);
70        // The counter will always fit in a `u32` because we reject absurdly
71        // long inputs very early.
72        ctx.update(&u32::to_be_bytes(i.try_into().unwrap()));
73        let digest = ctx.finish();
74
75        // The last chunk may legitimately be shorter than `digest`, but
76        // `digest` will never be shorter than `out`.
77        bb::xor_assign_at_start(out, digest.as_ref());
78    }
79}
80
81#[cfg(test)]
82mod test {
83    use super::*;
84    use crate::{digest, error, test};
85    use alloc::vec;
86
87    #[test]
88    fn test_pss_padding_verify() {
89        test::run(
90            test_file!("rsa_pss_padding_tests.txt"),
91            |section, test_case| {
92                assert_eq!(section, "");
93
94                let digest_name = test_case.consume_string("Digest");
95                let alg = match digest_name.as_ref() {
96                    "SHA256" => &RSA_PSS_SHA256,
97                    "SHA384" => &RSA_PSS_SHA384,
98                    "SHA512" => &RSA_PSS_SHA512,
99                    _ => panic!("Unsupported digest: {}", digest_name),
100                };
101
102                let msg = test_case.consume_bytes("Msg");
103                let msg = untrusted::Input::from(&msg);
104                let m_hash = digest::digest(alg.digest_alg(), msg.as_slice_less_safe());
105
106                let encoded = test_case.consume_bytes("EM");
107                let encoded = untrusted::Input::from(&encoded);
108
109                // Salt is recomputed in verification algorithm.
110                let _ = test_case.consume_bytes("Salt");
111
112                let bit_len = test_case.consume_usize_bits("Len");
113                let is_valid = test_case.consume_string("Result") == "P";
114
115                let actual_result =
116                    encoded.read_all(error::Unspecified, |m| alg.verify(m_hash, m, bit_len));
117                assert_eq!(actual_result.is_ok(), is_valid);
118
119                Ok(())
120            },
121        );
122    }
123
124    // Tests PSS encoding for various public modulus lengths.
125    #[cfg(feature = "alloc")]
126    #[test]
127    fn test_pss_padding_encode() {
128        test::run(
129            test_file!("rsa_pss_padding_tests.txt"),
130            |section, test_case| {
131                assert_eq!(section, "");
132
133                let digest_name = test_case.consume_string("Digest");
134                let alg = match digest_name.as_ref() {
135                    "SHA256" => &RSA_PSS_SHA256,
136                    "SHA384" => &RSA_PSS_SHA384,
137                    "SHA512" => &RSA_PSS_SHA512,
138                    _ => panic!("Unsupported digest: {}", digest_name),
139                };
140
141                let msg = test_case.consume_bytes("Msg");
142                let salt = test_case.consume_bytes("Salt");
143                let encoded = test_case.consume_bytes("EM");
144                let bit_len = test_case.consume_usize_bits("Len");
145                let expected_result = test_case.consume_string("Result");
146
147                // Only test the valid outputs
148                if expected_result != "P" {
149                    return Ok(());
150                }
151
152                let rng = test::rand::FixedSliceRandom { bytes: &salt };
153
154                let mut m_out = vec![0u8; bit_len.as_usize_bytes_rounded_up()];
155                let digest = digest::digest(alg.digest_alg(), &msg);
156                alg.encode(digest, &mut m_out, bit_len, &rng).unwrap();
157                assert_eq!(m_out, encoded);
158
159                Ok(())
160            },
161        );
162    }
163}
ring/rsa/padding.rs

ring/rsa/
padding.rs
