Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for using a different MGF1 hash with RSA-OAEP #6779

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add support for using a different MGF1 hash with RSA-OAEP #6779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions core/crypto/crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -597,6 +597,7 @@ TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo __unused,
struct rsa_keypair *key __unused,
const uint8_t *label __unused,
size_t label_len __unused,
uint32_t mgf_algo __unused,
const uint8_t *src __unused,
size_t src_len __unused,
uint8_t *dst __unused,
Expand All @@ -609,6 +610,7 @@ TEE_Result crypto_acipher_rsaes_encrypt(uint32_t algo __unused,
struct rsa_public_key *key __unused,
const uint8_t *label __unused,
size_t label_len __unused,
uint32_t mgf_algo __unused,
const uint8_t *src __unused,
size_t src_len __unused,
uint8_t *dst __unused,
Expand Down
8 changes: 4 additions & 4 deletions core/drivers/crypto/caam/acipher/caam_rsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -890,8 +890,8 @@ static TEE_Result do_oaep_decoding(struct drvcrypt_rsa_ed *rsa_data)
*
* Note: Use same buffer for seed and seedMask
*/
mgf_data.hash_algo = rsa_data->hash_algo;
mgf_data.digest_size = rsa_data->digest_size;
mgf_data.hash_algo = rsa_data->mgf_algo;
mgf_data.digest_size = rsa_data->mgf_size;
mgf_data.seed.data = maskedDB.data;
mgf_data.seed.length = maskedDB.length;
mgf_data.mask.data = seed.data;
Expand Down Expand Up @@ -1123,8 +1123,8 @@ static TEE_Result do_oaep_encoding(struct drvcrypt_rsa_ed *rsa_data)
* Generate a Mask of the seed value
* dbMask = MGF(seed, k - hLen - 1)
*/
mgf_data.hash_algo = rsa_data->hash_algo;
mgf_data.digest_size = rsa_data->digest_size;
mgf_data.hash_algo = rsa_data->mgf_algo;
mgf_data.digest_size = rsa_data->mgf_size;
mgf_data.seed.data = seed.data;
mgf_data.seed.length = seed.length;
mgf_data.mask.data = dbMask.data;
Expand Down
14 changes: 14 additions & 0 deletions core/drivers/crypto/crypto_api/acipher/rsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,7 @@ TEE_Result crypto_acipher_rsanopad_encrypt(struct rsa_public_key *key,

TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo, struct rsa_keypair *key,
const uint8_t *label, size_t label_len,
uint32_t mgf_algo,
const uint8_t *cipher,
size_t cipher_len, uint8_t *msg,
size_t *msg_len)
Expand Down Expand Up @@ -231,6 +232,12 @@ TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo, struct rsa_keypair *key,
if (ret != TEE_SUCCESS)
return ret;

rsa_data.mgf_algo = mgf_algo;
ret = tee_alg_get_digest_size(rsa_data.mgf_algo,
&rsa_data.mgf_size);
if (ret != TEE_SUCCESS)
return ret;

rsa_data.mgf = &drvcrypt_rsa_mgf1;
}

Expand Down Expand Up @@ -261,6 +268,7 @@ TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo, struct rsa_keypair *key,
TEE_Result crypto_acipher_rsaes_encrypt(uint32_t algo,
struct rsa_public_key *key,
const uint8_t *label, size_t label_len,
uint32_t mgf_algo,
const uint8_t *msg, size_t msg_len,
uint8_t *cipher, size_t *cipher_len)
{
Expand Down Expand Up @@ -322,6 +330,12 @@ TEE_Result crypto_acipher_rsaes_encrypt(uint32_t algo,
rsa_data.key.n_size - 2 * rsa_data.digest_size - 2)
return TEE_ERROR_BAD_PARAMETERS;

rsa_data.mgf_algo = mgf_algo;
ret = tee_alg_get_digest_size(rsa_data.mgf_algo,
&rsa_data.mgf_size);
if (ret != TEE_SUCCESS)
return ret;

rsa_data.mgf = &drvcrypt_rsa_mgf1;
}

Expand Down
2 changes: 2 additions & 0 deletions core/drivers/crypto/crypto_api/include/drvcrypt_acipher.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,8 @@ struct drvcrypt_rsa_ed {
struct drvcrypt_buf message; /* Message to encrypt or decrypted */
struct drvcrypt_buf cipher; /* Cipher encrypted or to decrypt */
struct drvcrypt_buf label; /* Additional Label (RSAES) */
uint32_t mgf_algo; /* MGF1 hash algorithm (RSAES) */
size_t mgf_size; /* MGF1 hash digest size (RSAES) */

/* RSA Mask Generation function */
TEE_Result (*mgf)(struct drvcrypt_rsa_mgf *mgf_data);
Expand Down
8 changes: 6 additions & 2 deletions core/drivers/crypto/se050/core/rsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -689,6 +689,7 @@ static TEE_Result encrypt_fallback(struct drvcrypt_rsa_ed *p)
p->key.key,
p->label.data,
p->label.length,
p->mgf_algo,
p->message.data,
p->message.length,
p->cipher.data,
Expand Down Expand Up @@ -720,7 +721,8 @@ static TEE_Result do_encrypt(struct drvcrypt_rsa_ed *rsa_data)
&rsa_data->cipher.length);

case DRVCRYPT_RSA_OAEP:
if (rsa_data->hash_algo != TEE_ALG_SHA1)
if (rsa_data->hash_algo != TEE_ALG_SHA1 ||
rsa_data->hash_algo != rsa_data->mgf_algo)
return encrypt_fallback(rsa_data);

return encrypt_es(TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1,
Expand Down Expand Up @@ -764,6 +766,7 @@ static TEE_Result decrypt_fallback(struct drvcrypt_rsa_ed *p)
p->key.key,
p->label.data,
p->label.length,
p->mgf_algo,
p->cipher.data,
p->cipher.length,
p->message.data,
Expand Down Expand Up @@ -798,7 +801,8 @@ static TEE_Result do_decrypt(struct drvcrypt_rsa_ed *rsa_data)
&rsa_data->message.length);

case DRVCRYPT_RSA_OAEP:
if (rsa_data->hash_algo != TEE_ALG_SHA1)
if (rsa_data->hash_algo != TEE_ALG_SHA1 ||
rsa_data->hash_algo != rsa_data->mgf_algo)
return decrypt_fallback(rsa_data);

return decrypt_es(TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1,
Expand Down
4 changes: 4 additions & 0 deletions core/drivers/crypto/versal/rsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ static TEE_Result do_encrypt(struct drvcrypt_rsa_ed *rsa_data)
rsa_data->key.key,
rsa_data->label.data,
rsa_data->label.length,
rsa_data->mgf_algo,
rsa_data->message.data,
rsa_data->message.length,
rsa_data->cipher.data,
Expand All @@ -53,6 +54,7 @@ static TEE_Result do_encrypt(struct drvcrypt_rsa_ed *rsa_data)
rsa_data->key.key,
rsa_data->label.data,
rsa_data->label.length,
rsa_data->mgf_algo,
rsa_data->message.data,
rsa_data->message.length,
rsa_data->cipher.data,
Expand Down Expand Up @@ -133,6 +135,7 @@ static TEE_Result do_decrypt(struct drvcrypt_rsa_ed *rsa_data)
rsa_data->key.key,
rsa_data->label.data,
rsa_data->label.length,
rsa_data->mgf_algo,
rsa_data->cipher.data,
rsa_data->cipher.length,
rsa_data->message.data,
Expand All @@ -142,6 +145,7 @@ static TEE_Result do_decrypt(struct drvcrypt_rsa_ed *rsa_data)
rsa_data->key.key,
rsa_data->label.data,
rsa_data->label.length,
rsa_data->mgf_algo,
rsa_data->cipher.data,
rsa_data->cipher.length,
rsa_data->message.data,
Expand Down
2 changes: 2 additions & 0 deletions core/include/crypto/crypto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,11 +261,13 @@ TEE_Result crypto_acipher_rsanopad_encrypt(struct rsa_public_key *key,
uint8_t *dst, size_t *dst_len);
TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo, struct rsa_keypair *key,
const uint8_t *label, size_t label_len,
uint32_t mgf_algo,
const uint8_t *src, size_t src_len,
uint8_t *dst, size_t *dst_len);
TEE_Result crypto_acipher_rsaes_encrypt(uint32_t algo,
struct rsa_public_key *key,
const uint8_t *label, size_t label_len,
uint32_t mgf_algo,
const uint8_t *src, size_t src_len,
uint8_t *dst, size_t *dst_len);
/* RSA SSA sign/verify: if salt_len == -1, use default value */
Expand Down
8 changes: 6 additions & 2 deletions core/include/crypto/crypto_impl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,14 +532,18 @@ TEE_Result sw_crypto_acipher_rsanopad_encrypt(struct rsa_public_key *key,
TEE_Result sw_crypto_acipher_rsaes_decrypt(uint32_t algo,
struct rsa_keypair *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len);

TEE_Result sw_crypto_acipher_rsaes_encrypt(uint32_t algo,
struct rsa_public_key *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len);

Expand Down
53 changes: 43 additions & 10 deletions core/lib/libtomcrypt/rsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,41 +30,47 @@ static TEE_Result tee_algo_to_ltc_hashindex(uint32_t algo, int *ltc_hashindex)
{
switch (algo) {
#if defined(_CFG_CORE_LTC_SHA1_DESC)
case TEE_ALG_SHA1:
case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1:
*ltc_hashindex = find_hash("sha1");
break;
#endif
#if defined(_CFG_CORE_LTC_MD5_DESC)
case TEE_ALG_MD5:
case TEE_ALG_RSASSA_PKCS1_V1_5_MD5:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_MD5:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_MD5:
*ltc_hashindex = find_hash("md5");
break;
#endif
#if defined(_CFG_CORE_LTC_SHA224_DESC)
case TEE_ALG_SHA224:
case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224:
*ltc_hashindex = find_hash("sha224");
break;
#endif
#if defined(_CFG_CORE_LTC_SHA256_DESC)
case TEE_ALG_SHA256:
case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256:
*ltc_hashindex = find_hash("sha256");
break;
#endif
#if defined(_CFG_CORE_LTC_SHA384_DESC)
case TEE_ALG_SHA384:
case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384:
*ltc_hashindex = find_hash("sha384");
break;
#endif
#if defined(_CFG_CORE_LTC_SHA512_DESC)
case TEE_ALG_SHA512:
case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512:
case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512:
case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512:
Expand Down Expand Up @@ -319,22 +325,26 @@ TEE_Result sw_crypto_acipher_rsanopad_decrypt(struct rsa_keypair *key,
TEE_Result crypto_acipher_rsaes_decrypt(uint32_t algo,
struct rsa_keypair *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len)
__weak __alias("sw_crypto_acipher_rsaes_decrypt");

TEE_Result sw_crypto_acipher_rsaes_decrypt(uint32_t algo,
struct rsa_keypair *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len)
{
TEE_Result res = TEE_SUCCESS;
void *buf = NULL;
unsigned long blen;
int ltc_hashindex, ltc_res, ltc_stat, ltc_rsa_algo;
int ltc_hashindex, ltc_mgfindex, ltc_res, ltc_stat, ltc_rsa_algo;
size_t mod_size;
rsa_key ltc_key = { 0, };

Expand All @@ -353,9 +363,19 @@ TEE_Result sw_crypto_acipher_rsaes_decrypt(uint32_t algo,
/* Get the algorithm */
res = tee_algo_to_ltc_hashindex(algo, &ltc_hashindex);
if (res != TEE_SUCCESS) {
EMSG("tee_algo_to_ltc_hashindex() returned %d", (int)res);
EMSG("tee_algo_to_ltc_hashindex() returned %#"PRIx32, res);
goto out;
}
if (algo != TEE_ALG_RSAES_PKCS1_V1_5) {
res = tee_algo_to_ltc_hashindex(mgf_algo, &ltc_mgfindex);
if (res != TEE_SUCCESS) {
EMSG("tee_algo_to_ltc_hashindex() returned %#"PRIx32"for mgf algo %#"PRIx32,
res, mgf_algo);
goto out;
}
} else {
ltc_mgfindex = -1;
}

/*
* Use a temporary buffer since we don't know exactly how large
Expand All @@ -380,8 +400,8 @@ TEE_Result sw_crypto_acipher_rsaes_decrypt(uint32_t algo,

ltc_res = rsa_decrypt_key_ex(src, src_len, buf, &blen,
((label_len == 0) ? 0 : label), label_len,
ltc_hashindex, -1, ltc_rsa_algo, &ltc_stat,
&ltc_key);
ltc_mgfindex, ltc_hashindex, ltc_rsa_algo,
&ltc_stat, &ltc_key);
switch (ltc_res) {
case CRYPT_PK_INVALID_PADDING:
case CRYPT_INVALID_PACKET:
Expand Down Expand Up @@ -424,21 +444,25 @@ TEE_Result sw_crypto_acipher_rsaes_decrypt(uint32_t algo,
TEE_Result crypto_acipher_rsaes_encrypt(uint32_t algo,
struct rsa_public_key *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len)
__weak __alias("sw_crypto_acipher_rsaes_encrypt");

TEE_Result sw_crypto_acipher_rsaes_encrypt(uint32_t algo,
struct rsa_public_key *key,
const uint8_t *label,
size_t label_len, const uint8_t *src,
size_t label_len,
uint32_t mgf_algo,
const uint8_t *src,
size_t src_len, uint8_t *dst,
size_t *dst_len)
{
TEE_Result res;
uint32_t mod_size;
int ltc_hashindex, ltc_res, ltc_rsa_algo;
int ltc_hashindex, ltc_mgfindex, ltc_res, ltc_rsa_algo;
rsa_key ltc_key = {
.type = PK_PUBLIC,
.e = key->e,
Expand All @@ -458,6 +482,14 @@ TEE_Result sw_crypto_acipher_rsaes_encrypt(uint32_t algo,
if (res != TEE_SUCCESS)
goto out;

if (algo != TEE_ALG_RSAES_PKCS1_V1_5) {
res = tee_algo_to_ltc_hashindex(mgf_algo, &ltc_mgfindex);
if (res != TEE_SUCCESS)
goto out;
} else {
ltc_mgfindex = -1;
}

if (algo == TEE_ALG_RSAES_PKCS1_V1_5)
ltc_rsa_algo = LTC_PKCS_1_V1_5;
else
Expand All @@ -466,7 +498,8 @@ TEE_Result sw_crypto_acipher_rsaes_encrypt(uint32_t algo,
ltc_res = rsa_encrypt_key_ex(src, src_len, dst,
(unsigned long *)(dst_len), label,
label_len, NULL, find_prng("prng_crypto"),
ltc_hashindex, -1, ltc_rsa_algo, &ltc_key);
ltc_mgfindex, ltc_hashindex, ltc_rsa_algo,
&ltc_key);
switch (ltc_res) {
case CRYPT_PK_INVALID_PADDING:
case CRYPT_INVALID_PACKET:
Expand Down