rsa_lib.c 11.2 KB
Newer Older
1
/* crypto/rsa/rsa_lib.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
60
#include <openssl/crypto.h>
61
#include "cryptlib.h"
62 63 64
#include <openssl/lhash.h>
#include <openssl/bn.h>
#include <openssl/rsa.h>
65
#include <openssl/rand.h>
66
#ifndef OPENSSL_NO_ENGINE
67
#include <openssl/engine.h>
68
#endif
69

B
Ben Laurie 已提交
70
const char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
71

R
Richard Levitte 已提交
72
static const RSA_METHOD *default_RSA_meth=NULL;
73

U
Ulf Möller 已提交
74
RSA *RSA_new(void)
75
	{
76 77 78
	RSA *r=RSA_new_method(NULL);

	return r;
79 80
	}

81
void RSA_set_default_method(const RSA_METHOD *meth)
82
	{
83
	default_RSA_meth = meth;
84 85
	}

86 87
const RSA_METHOD *RSA_get_default_method(void)
	{
88 89 90 91 92
	if (default_RSA_meth == NULL)
		{
#ifdef RSA_NULL
		default_RSA_meth=RSA_null_method();
#else
93
#if 0 /* was: #ifdef RSAref */
94 95 96 97 98 99 100
		default_RSA_meth=RSA_PKCS1_RSAref();
#else
		default_RSA_meth=RSA_PKCS1_SSLeay();
#endif
#endif
		}

101
	return default_RSA_meth;
102
	}
103

R
Richard Levitte 已提交
104
const RSA_METHOD *RSA_get_method(const RSA *rsa)
105 106 107 108 109 110 111 112 113
	{
	return rsa->meth;
	}

int RSA_set_method(RSA *rsa, const RSA_METHOD *meth)
	{
	/* NB: The caller is specifically setting a method, so it's not up to us
	 * to deal with which ENGINE it comes from. */
	const RSA_METHOD *mtmp;
114 115
	mtmp = rsa->meth;
	if (mtmp->finish) mtmp->finish(rsa);
116
#ifndef OPENSSL_NO_ENGINE
117 118 119 120 121
	if (rsa->engine)
		{
		ENGINE_finish(rsa->engine);
		rsa->engine = NULL;
		}
122
#endif
123 124
	rsa->meth = meth;
	if (meth->init) meth->init(rsa);
125
	return 1;
126
	}
127

128
RSA *RSA_new_method(ENGINE *engine)
129 130 131
	{
	RSA *ret;

132
	ret=(RSA *)OPENSSL_malloc(sizeof(RSA));
133 134 135
	if (ret == NULL)
		{
		RSAerr(RSA_F_RSA_NEW_METHOD,ERR_R_MALLOC_FAILURE);
G
Geoff Thorpe 已提交
136
		return NULL;
137 138
		}

139
	ret->meth = RSA_get_default_method();
140
#ifndef OPENSSL_NO_ENGINE
D
 
Dr. Stephen Henson 已提交
141 142 143 144 145 146 147 148 149 150 151
	if (engine)
		{
		if (!ENGINE_init(engine))
			{
			RSAerr(RSA_F_RSA_NEW_METHOD, ERR_R_ENGINE_LIB);
			OPENSSL_free(ret);
			return NULL;
			}
		ret->engine = engine;
		}
	else
152 153
		ret->engine = ENGINE_get_default_RSA();
	if(ret->engine)
154
		{
155 156 157 158 159 160 161 162 163
		ret->meth = ENGINE_get_RSA(ret->engine);
		if(!ret->meth)
			{
			RSAerr(RSA_F_RSA_NEW_METHOD,
				ERR_R_ENGINE_LIB);
			ENGINE_finish(ret->engine);
			OPENSSL_free(ret);
			return NULL;
			}
164
		}
165
#endif
166

167 168 169 170 171 172 173 174 175 176 177
	ret->pad=0;
	ret->version=0;
	ret->n=NULL;
	ret->e=NULL;
	ret->d=NULL;
	ret->p=NULL;
	ret->q=NULL;
	ret->dmp1=NULL;
	ret->dmq1=NULL;
	ret->iqmp=NULL;
	ret->references=1;
178 179 180
	ret->_method_mod_n=NULL;
	ret->_method_mod_p=NULL;
	ret->_method_mod_q=NULL;
181
	ret->blinding=NULL;
182
	ret->mt_blinding=NULL;
183
	ret->bignum_data=NULL;
184
	ret->flags=ret->meth->flags;
185
	CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data);
186
	if ((ret->meth->init != NULL) && !ret->meth->init(ret))
187
		{
188
#ifndef OPENSSL_NO_ENGINE
D
 
Dr. Stephen Henson 已提交
189 190
		if (ret->engine)
			ENGINE_finish(ret->engine);
191
#endif
192
		CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data);
193
		OPENSSL_free(ret);
194 195 196 197 198
		ret=NULL;
		}
	return(ret);
	}

U
Ulf Möller 已提交
199
void RSA_free(RSA *r)
200 201 202 203 204 205
	{
	int i;

	if (r == NULL) return;

	i=CRYPTO_add(&r->references,-1,CRYPTO_LOCK_RSA);
206 207 208
#ifdef REF_PRINT
	REF_PRINT("RSA",r);
#endif
209 210 211 212 213 214 215 216 217
	if (i > 0) return;
#ifdef REF_CHECK
	if (i < 0)
		{
		fprintf(stderr,"RSA_free, bad reference count\n");
		abort();
		}
#endif

218 219
	if (r->meth->finish)
		r->meth->finish(r);
220
#ifndef OPENSSL_NO_ENGINE
221 222
	if (r->engine)
		ENGINE_finish(r->engine);
223
#endif
224

225
	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RSA, r, &r->ex_data);
226

227 228 229 230 231 232 233 234
	if (r->n != NULL) BN_clear_free(r->n);
	if (r->e != NULL) BN_clear_free(r->e);
	if (r->d != NULL) BN_clear_free(r->d);
	if (r->p != NULL) BN_clear_free(r->p);
	if (r->q != NULL) BN_clear_free(r->q);
	if (r->dmp1 != NULL) BN_clear_free(r->dmp1);
	if (r->dmq1 != NULL) BN_clear_free(r->dmq1);
	if (r->iqmp != NULL) BN_clear_free(r->iqmp);
235
	if (r->blinding != NULL) BN_BLINDING_free(r->blinding);
236
	if (r->mt_blinding != NULL) BN_BLINDING_free(r->mt_blinding);
237 238
	if (r->bignum_data != NULL) OPENSSL_free_locked(r->bignum_data);
	OPENSSL_free(r);
239 240
	}

241
int RSA_up_ref(RSA *r)
242 243 244 245 246 247 248 249
	{
	int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_RSA);
#ifdef REF_PRINT
	REF_PRINT("RSA",r);
#endif
#ifdef REF_CHECK
	if (i < 2)
		{
250
		fprintf(stderr, "RSA_up_ref, bad reference count\n");
251 252 253 254 255 256
		abort();
		}
#endif
	return ((i > 1) ? 1 : 0);
	}

D
 
Dr. Stephen Henson 已提交
257 258
int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
	     CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
259
        {
260 261
	return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_RSA, argl, argp,
				new_func, dup_func, free_func);
262 263
        }

D
 
Dr. Stephen Henson 已提交
264
int RSA_set_ex_data(RSA *r, int idx, void *arg)
265 266 267 268
	{
	return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
	}

R
Richard Levitte 已提交
269
void *RSA_get_ex_data(const RSA *r, int idx)
270 271 272 273
	{
	return(CRYPTO_get_ex_data(&r->ex_data,idx));
	}

R
Richard Levitte 已提交
274
int RSA_size(const RSA *r)
275 276 277 278
	{
	return(BN_num_bytes(r->n));
	}

R
Richard Levitte 已提交
279
int RSA_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
U
Ulf Möller 已提交
280
	     RSA *rsa, int padding)
281
	{
282
	return(rsa->meth->rsa_pub_enc(flen, from, to, rsa, padding));
283 284
	}

R
Richard Levitte 已提交
285
int RSA_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
U
Ulf Möller 已提交
286
	     RSA *rsa, int padding)
287
	{
288
	return(rsa->meth->rsa_priv_enc(flen, from, to, rsa, padding));
289 290
	}

R
Richard Levitte 已提交
291
int RSA_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
U
Ulf Möller 已提交
292
	     RSA *rsa, int padding)
293
	{
294
	return(rsa->meth->rsa_priv_dec(flen, from, to, rsa, padding));
295 296
	}

R
Richard Levitte 已提交
297
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to,
U
Ulf Möller 已提交
298
	     RSA *rsa, int padding)
299
	{
300
	return(rsa->meth->rsa_pub_dec(flen, from, to, rsa, padding));
301 302
	}

R
Richard Levitte 已提交
303
int RSA_flags(const RSA *r)
304
	{
305
	return((r == NULL)?0:r->meth->flags);
306 307
	}

U
Ulf Möller 已提交
308
void RSA_blinding_off(RSA *rsa)
309 310 311 312 313 314
	{
	if (rsa->blinding != NULL)
		{
		BN_BLINDING_free(rsa->blinding);
		rsa->blinding=NULL;
		}
315 316
	rsa->flags &= ~RSA_FLAG_BLINDING;
	rsa->flags |= RSA_FLAG_NO_BLINDING;
317 318
	}

319
int RSA_blinding_on(RSA *rsa, BN_CTX *ctx)
320 321 322
	{
	int ret=0;

323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368
	if (rsa->blinding != NULL)
		RSA_blinding_off(rsa);

	rsa->blinding = RSA_setup_blinding(rsa, ctx);
	if (rsa->blinding == NULL)
		goto err;

	rsa->flags |= RSA_FLAG_BLINDING;
	rsa->flags &= ~RSA_FLAG_NO_BLINDING;
	ret=1;
err:
	return(ret);
	}

static BIGNUM *rsa_get_public_exp(const BIGNUM *d, const BIGNUM *p,
	const BIGNUM *q, BN_CTX *ctx)
{
	BIGNUM *ret = NULL, *r0, *r1, *r2;

	if (d == NULL || p == NULL || q == NULL)
		return NULL;

	BN_CTX_start(ctx);
	r0 = BN_CTX_get(ctx);
	r1 = BN_CTX_get(ctx);
	r2 = BN_CTX_get(ctx);
	if (r2 == NULL)
		goto err;

	if (!BN_sub(r1, p, BN_value_one())) goto err;
	if (!BN_sub(r2, q, BN_value_one())) goto err;
	if (!BN_mul(r0, r1, r2, ctx)) goto err;

	ret = BN_mod_inverse(NULL, d, r0, ctx);
err:
	BN_CTX_end(ctx);
	return ret;
}

BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx)
{
	BIGNUM *e;
	BN_CTX *ctx;
	BN_BLINDING *ret = NULL;

	if (in_ctx == NULL)
369
		{
370
		if ((ctx = BN_CTX_new()) == NULL) return 0;
371 372
		}
	else
373
		ctx = in_ctx;
374

375 376 377
	BN_CTX_start(ctx);
	e  = BN_CTX_get(ctx);
	if (e == NULL)
378
		{
379 380
		RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_MALLOC_FAILURE);
		goto err;
381
		}
382

383
	if (rsa->e == NULL)
384
		{
385 386 387 388 389 390
		e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);
		if (e == NULL)
			{
			RSAerr(RSA_F_RSA_SETUP_BLINDING, RSA_R_NO_PUBLIC_EXPONENT);
			goto err;
			}
391 392
		}
	else
393 394 395 396
		e = rsa->e;

	
	if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
397
		{
398 399 400
		/* if PRNG is not properly seeded, resort to secret
		 * exponent as unpredictable seed */
		RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0.0);
401
		}
402

403 404 405
	ret = BN_BLINDING_create_param(NULL, e, rsa->n, ctx,
			rsa->meth->bn_mod_exp, rsa->_method_mod_n);
	BN_BLINDING_set_thread_id(ret, CRYPTO_thread_id());
406
err:
407
	BN_CTX_end(ctx);
408 409 410 411 412
	if (in_ctx == NULL)
		BN_CTX_free(ctx);

	return ret;
}
413

U
Ulf Möller 已提交
414
int RSA_memory_lock(RSA *r)
415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432
	{
	int i,j,k,off;
	char *p;
	BIGNUM *bn,**t[6],*b;
	BN_ULONG *ul;

	if (r->d == NULL) return(1);
	t[0]= &r->d;
	t[1]= &r->p;
	t[2]= &r->q;
	t[3]= &r->dmp1;
	t[4]= &r->dmq1;
	t[5]= &r->iqmp;
	k=sizeof(BIGNUM)*6;
	off=k/sizeof(BN_ULONG)+1;
	j=1;
	for (i=0; i<6; i++)
		j+= (*t[i])->top;
433
	if ((p=OPENSSL_malloc_locked((off+j)*sizeof(BN_ULONG))) == NULL)
434
		{
B
Bodo Möller 已提交
435
		RSAerr(RSA_F_RSA_MEMORY_LOCK,ERR_R_MALLOC_FAILURE);
436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457
		return(0);
		}
	bn=(BIGNUM *)p;
	ul=(BN_ULONG *)&(p[off]);
	for (i=0; i<6; i++)
		{
		b= *(t[i]);
		*(t[i])= &(bn[i]);
		memcpy((char *)&(bn[i]),(char *)b,sizeof(BIGNUM));
		bn[i].flags=BN_FLG_STATIC_DATA;
		bn[i].d=ul;
		memcpy((char *)ul,b->d,sizeof(BN_ULONG)*b->top);
		ul+=b->top;
		BN_clear_free(b);
		}
	
	/* I should fix this so it can still be done */
	r->flags&= ~(RSA_FLAG_CACHE_PRIVATE|RSA_FLAG_CACHE_PUBLIC);

	r->bignum_data=p;
	return(1);
	}