Mercurial > dropbear

comparison src/pk/pkcs1/pkcs_1_pss_decode.c @ 191:1c15b283127b libtomcrypt-orig

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Import of libtomcrypt 1.02 with manual path rename rearrangement etc
author Matt Johnston <matt@ucc.asn.au>
date Fri, 06 May 2005 13:23:02 +0000
parents
children 39d5d58461d6
comparison
equal deleted inserted replaced
143:5d99163f7e32 191:1c15b283127b
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11 #include "tomcrypt.h"
12
13 /**
14 @file pkcs_1_pss_decode.c
15 PKCS #1 PSS Signature Padding, Tom St Denis
16 */
17
18 #ifdef PKCS_1
19
20 /**
21 PKCS #1 v2.00 PSS decode
22 @param msghash The hash to verify
23 @param msghashlen The length of the hash (octets)
24 @param sig The signature data (encoded data)
25 @param siglen The length of the signature data (octets)
26 @param saltlen The length of the salt used (octets)
27 @param hash_idx The index of the hash desired
28 @param modulus_bitlen The bit length of the RSA modulus
29 @param res [out] The result of the comparison, 1==valid, 0==invalid
30 @return CRYPT_OK if successful (even if the comparison failed)
31 */
32 int pkcs_1_pss_decode(const unsigned char *msghash, unsigned long msghashlen,
33 const unsigned char *sig, unsigned long siglen,
34 unsigned long saltlen, int hash_idx,
35 unsigned long modulus_bitlen, int *res)
36 {
37 unsigned char *DB, *mask, *salt, *hash;
38 unsigned long x, y, hLen, modulus_len;
39 int err;
40 hash_state md;
41
42 LTC_ARGCHK(msghash != NULL);
43 LTC_ARGCHK(res != NULL);
44
45 /* default to invalid */
46 *res = 0;
47
48 /* ensure hash is valid */
49 if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
50 return err;
51 }
52
53 hLen = hash_descriptor[hash_idx].hashsize;
54 modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
55
56 /* check sizes */
57 if ((saltlen > modulus_len) ||
58 (modulus_len < hLen + saltlen + 2) || (siglen != modulus_len)) {
59 return CRYPT_PK_INVALID_SIZE;
60 }
61
62 /* allocate ram for DB/mask/salt/hash of size modulus_len */
63 DB = XMALLOC(modulus_len);
64 mask = XMALLOC(modulus_len);
65 salt = XMALLOC(modulus_len);
66 hash = XMALLOC(modulus_len);
67 if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
68 if (DB != NULL) {
69 XFREE(DB);
70 }
71 if (mask != NULL) {
72 XFREE(mask);
73 }
74 if (salt != NULL) {
75 XFREE(salt);
76 }
77 if (hash != NULL) {
78 XFREE(hash);
79 }
80 return CRYPT_MEM;
81 }
82
83 /* ensure the 0xBC byte */
84 if (sig[siglen-1] != 0xBC) {
85 err = CRYPT_OK;
86 goto LBL_ERR;
87 }
88
89 /* copy out the DB */
90 for (x = 0; x < modulus_len - hLen - 1; x++) {
91 DB[x] = sig[x];
92 }
93
94 /* copy out the hash */
95 for (y = 0; y < hLen; y++) {
96 hash[y] = sig[x++];
97 }
98
99 /* check the MSB */
100 if ((sig[0] & ~(0xFF >> ((modulus_len<<3) - (modulus_bitlen-1)))) != 0) {
101 err = CRYPT_OK;
102 goto LBL_ERR;
103 }
104
105 /* generate mask of length modulus_len - hLen - 1 from hash */
106 if ((err = pkcs_1_mgf1(hash, hLen, hash_idx, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
107 goto LBL_ERR;
108 }
109
110 /* xor against DB */
111 for (y = 0; y < (modulus_len - hLen - 1); y++) {
112 DB[y] ^= mask[y];
113 }
114
115 /* now clear the first byte [make sure smaller than modulus] */
116 DB[0] &= 0xFF >> ((modulus_len<<3) - (modulus_bitlen-1));
117
118 /* DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
119
120 /* check for zeroes and 0x01 */
121 for (x = 0; x < modulus_len - saltlen - hLen - 2; x++) {
122 if (DB[x] != 0x00) {
123 err = CRYPT_OK;
124 goto LBL_ERR;
125 }
126 }
127
128 /* check for the 0x01 */
129 if (DB[x++] != 0x01) {
130 err = CRYPT_OK;
131 goto LBL_ERR;
132 }
133
134 /* M = (eight) 0x00 || msghash || salt, mask = H(M) */
135 if ((err = hash_descriptor[hash_idx].init(&md)) != CRYPT_OK) {
136 goto LBL_ERR;
137 }
138 zeromem(mask, 8);
139 if ((err = hash_descriptor[hash_idx].process(&md, mask, 8)) != CRYPT_OK) {
140 goto LBL_ERR;
141 }
142 if ((err = hash_descriptor[hash_idx].process(&md, msghash, msghashlen)) != CRYPT_OK) {
143 goto LBL_ERR;
144 }
145 if ((err = hash_descriptor[hash_idx].process(&md, DB+x, saltlen)) != CRYPT_OK) {
146 goto LBL_ERR;
147 }
148 if ((err = hash_descriptor[hash_idx].done(&md, mask)) != CRYPT_OK) {
149 goto LBL_ERR;
150 }
151
152 /* mask == hash means valid signature */
153 if (memcmp(mask, hash, hLen) == 0) {
154 *res = 1;
155 }
156
157 err = CRYPT_OK;
158 LBL_ERR:
159 #ifdef LTC_CLEAN_STACK
160 zeromem(DB, modulus_len);
161 zeromem(mask, modulus_len);
162 zeromem(salt, modulus_len);
163 zeromem(hash, modulus_len);
164 #endif
165
166 XFREE(hash);
167 XFREE(salt);
168 XFREE(mask);
169 XFREE(DB);
170
171 return err;
172 }
173
174 #endif /* PKCS_1 */