[efi-boot-shim.git] / Cryptlib / OpenSSL / crypto / rsa / rsa_sign.c

/* crypto/rsa/rsa_sign.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 *
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 *
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 *
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include "cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
#include <openssl/objects.h>
#include <openssl/x509.h>
#include "rsa_locl.h"

/* Size of an SSL signature: MD5+SHA1 */
#define SSL_SIG_LENGTH  36

int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
             unsigned char *sigret, unsigned int *siglen, RSA *rsa)
{
    X509_SIG sig;
    ASN1_TYPE parameter;
    int i, j, ret = 1;
    unsigned char *p, *tmps = NULL;
    const unsigned char *s = NULL;
    X509_ALGOR algor;
    ASN1_OCTET_STRING digest;
#ifdef OPENSSL_FIPS
    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
        RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
        return 0;
    }
#endif
    if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign) {
        return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
    }
    /* Special case: SSL signature, just check the length */
    if (type == NID_md5_sha1) {
        if (m_len != SSL_SIG_LENGTH) {
            RSAerr(RSA_F_RSA_SIGN, RSA_R_INVALID_MESSAGE_LENGTH);
            return (0);
        }
        i = SSL_SIG_LENGTH;
        s = m;
    } else {
        sig.algor = &algor;
        sig.algor->algorithm = OBJ_nid2obj(type);
        if (sig.algor->algorithm == NULL) {
            RSAerr(RSA_F_RSA_SIGN, RSA_R_UNKNOWN_ALGORITHM_TYPE);
            return (0);
        }
        if (sig.algor->algorithm->length == 0) {
            RSAerr(RSA_F_RSA_SIGN,
                   RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
            return (0);
        }
        parameter.type = V_ASN1_NULL;
        parameter.value.ptr = NULL;
        sig.algor->parameter = &parameter;

        sig.digest = &digest;
        sig.digest->data = (unsigned char *)m; /* TMP UGLY CAST */
        sig.digest->length = m_len;

        i = i2d_X509_SIG(&sig, NULL);
    }
    j = RSA_size(rsa);
    if (i > (j - RSA_PKCS1_PADDING_SIZE)) {
        RSAerr(RSA_F_RSA_SIGN, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
        return (0);
    }
    if (type != NID_md5_sha1) {
        tmps = (unsigned char *)OPENSSL_malloc((unsigned int)j + 1);
        if (tmps == NULL) {
            RSAerr(RSA_F_RSA_SIGN, ERR_R_MALLOC_FAILURE);
            return (0);
        }
        p = tmps;
        i2d_X509_SIG(&sig, &p);
        s = tmps;
    }
    i = RSA_private_encrypt(i, s, sigret, rsa, RSA_PKCS1_PADDING);
    if (i <= 0)
        ret = 0;
    else
        *siglen = i;

    if (type != NID_md5_sha1) {
        OPENSSL_cleanse(tmps, (unsigned int)j + 1);
        OPENSSL_free(tmps);
    }
    return (ret);
}

/*
 * Check DigestInfo structure does not contain extraneous data by reencoding
 * using DER and checking encoding against original.
 */
static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo,
                                int dinfolen)
{
    unsigned char *der = NULL;
    int derlen;
    int ret = 0;
    derlen = i2d_X509_SIG(sig, &der);
    if (derlen <= 0)
        return 0;
    if (derlen == dinfolen && !memcmp(dinfo, der, derlen))
        ret = 1;
    OPENSSL_cleanse(der, derlen);
    OPENSSL_free(der);
    return ret;
}

int int_rsa_verify(int dtype, const unsigned char *m,
                   unsigned int m_len,
                   unsigned char *rm, size_t *prm_len,
                   const unsigned char *sigbuf, size_t siglen, RSA *rsa)
{
    int i, ret = 0, sigtype;
    unsigned char *s;
    X509_SIG *sig = NULL;

#ifdef OPENSSL_FIPS
    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
        && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
        RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_NON_FIPS_RSA_METHOD);
        return 0;
    }
#endif

    if (siglen != (unsigned int)RSA_size(rsa)) {
        RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_WRONG_SIGNATURE_LENGTH);
        return (0);
    }

    if ((dtype == NID_md5_sha1) && rm) {
        i = RSA_public_decrypt((int)siglen,
                               sigbuf, rm, rsa, RSA_PKCS1_PADDING);
        if (i <= 0)
            return 0;
        *prm_len = i;
        return 1;
    }

    s = (unsigned char *)OPENSSL_malloc((unsigned int)siglen);
    if (s == NULL) {
        RSAerr(RSA_F_INT_RSA_VERIFY, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if ((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH)) {
        RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
        goto err;
    }
    i = RSA_public_decrypt((int)siglen, sigbuf, s, rsa, RSA_PKCS1_PADDING);

    if (i <= 0)
        goto err;
    /*
     * Oddball MDC2 case: signature can be OCTET STRING. check for correct
     * tag and length octets.
     */
    if (dtype == NID_mdc2 && i == 18 && s[0] == 0x04 && s[1] == 0x10) {
        if (rm) {
            memcpy(rm, s + 2, 16);
            *prm_len = 16;
            ret = 1;
        } else if (memcmp(m, s + 2, 16)) {
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
        } else {
            ret = 1;
        }
    } else if (dtype == NID_md5_sha1) {
        /* Special case: SSL signature */
        if ((i != SSL_SIG_LENGTH) || memcmp(s, m, SSL_SIG_LENGTH))
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
        else
            ret = 1;
    } else {
        const unsigned char *p = s;
        sig = d2i_X509_SIG(NULL, &p, (long)i);

        if (sig == NULL)
            goto err;

        /* Excess data can be used to create forgeries */
        if (p != s + i || !rsa_check_digestinfo(sig, s, i)) {
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
            goto err;
        }

        /*
         * Parameters to the signature algorithm can also be used to create
         * forgeries
         */
        if (sig->algor->parameter
            && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) {
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
            goto err;
        }

        sigtype = OBJ_obj2nid(sig->algor->algorithm);

#ifdef RSA_DEBUG
        /* put a backward compatibility flag in EAY */
        fprintf(stderr, "in(%s) expect(%s)\n", OBJ_nid2ln(sigtype),
                OBJ_nid2ln(dtype));
#endif
        if (sigtype != dtype) {
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_ALGORITHM_MISMATCH);
            goto err;
        }
        if (rm) {
            const EVP_MD *md;
            md = EVP_get_digestbynid(dtype);
            if (md && (EVP_MD_size(md) != sig->digest->length))
                RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
            else {
                memcpy(rm, sig->digest->data, sig->digest->length);
                *prm_len = sig->digest->length;
                ret = 1;
            }
        } else if (((unsigned int)sig->digest->length != m_len) ||
                   (memcmp(m, sig->digest->data, m_len) != 0)) {
            RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
        } else
            ret = 1;
    }
 err:
    if (sig != NULL)
        X509_SIG_free(sig);
    if (s != NULL) {
        OPENSSL_cleanse(s, (unsigned int)siglen);
        OPENSSL_free(s);
    }
    return (ret);
}

int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
               const unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
{

    if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify) {
        return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
    }

    return int_rsa_verify(dtype, m, m_len, NULL, NULL, sigbuf, siglen, rsa);
}
Commit	Line	Data
031e5cce SM	1	/* crypto/rsa/rsa_sign.c */
	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
b6f94dbe	22	*
031e5cce SM	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
3e575651 SL	57	*/
	58
	59	#include <stdio.h>
031e5cce	60	#include "cryptlib.h"
3e575651 SL	61	#include <openssl/bn.h>
	62	#include <openssl/rsa.h>
	63	#include <openssl/objects.h>
	64	#include <openssl/x509.h>
d3819813	65	#include "rsa_locl.h"
3e575651 SL	66
3e575651 SL	67	/* Size of an SSL signature: MD5+SHA1 */
d3819813	68	#define SSL_SIG_LENGTH 36
3e575651	69
031e5cce SM	70	int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
031e5cce SM	71	unsigned char sigret, unsigned int siglen, RSA *rsa)
d3819813 MTL	72	{
d3819813 MTL	73	X509_SIG sig;
7bf7a6d0	74	ASN1_TYPE parameter;
031e5cce SM	75	int i, j, ret = 1;
	76	unsigned char p, tmps = NULL;
	77	const unsigned char *s = NULL;
	78	X509_ALGOR algor;
d3819813	79	ASN1_OCTET_STRING digest;
031e5cce SM	80	#ifdef OPENSSL_FIPS
	81	if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
	82	&& !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
	83	RSAerr(RSA_F_RSA_SIGN, RSA_R_NON_FIPS_RSA_METHOD);
d3819813 MTL	84	return 0;
d3819813 MTL	85	}
031e5cce SM	86	#endif
031e5cce SM	87	if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign) {
d3819813 MTL	88	return rsa->meth->rsa_sign(type, m, m_len, sigret, siglen, rsa);
d3819813 MTL	89	}
031e5cce	90	/* Special case: SSL signature, just check the length */
d3819813 MTL	91	if (type == NID_md5_sha1) {
	92	if (m_len != SSL_SIG_LENGTH) {
	93	RSAerr(RSA_F_RSA_SIGN, RSA_R_INVALID_MESSAGE_LENGTH);
031e5cce	94	return (0);
d3819813	95	}
031e5cce SM	96	i = SSL_SIG_LENGTH;
031e5cce SM	97	s = m;
d3819813	98	} else {
031e5cce SM	99	sig.algor = &algor;
	100	sig.algor->algorithm = OBJ_nid2obj(type);
	101	if (sig.algor->algorithm == NULL) {
	102	RSAerr(RSA_F_RSA_SIGN, RSA_R_UNKNOWN_ALGORITHM_TYPE);
	103	return (0);
	104	}
	105	if (sig.algor->algorithm->length == 0) {
	106	RSAerr(RSA_F_RSA_SIGN,
	107	RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
	108	return (0);
	109	}
	110	parameter.type = V_ASN1_NULL;
	111	parameter.value.ptr = NULL;
	112	sig.algor->parameter = &parameter;
7bf7a6d0	113
031e5cce SM	114	sig.digest = &digest;
	115	sig.digest->data = (unsigned char )m; / TMP UGLY CAST */
	116	sig.digest->length = m_len;
	117
	118	i = i2d_X509_SIG(&sig, NULL);
	119	}
	120	j = RSA_size(rsa);
	121	if (i > (j - RSA_PKCS1_PADDING_SIZE)) {
d3819813	122	RSAerr(RSA_F_RSA_SIGN, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY);
031e5cce	123	return (0);
b6f94dbe	124	}
031e5cce SM	125	if (type != NID_md5_sha1) {
	126	tmps = (unsigned char *)OPENSSL_malloc((unsigned int)j + 1);
	127	if (tmps == NULL) {
	128	RSAerr(RSA_F_RSA_SIGN, ERR_R_MALLOC_FAILURE);
	129	return (0);
	130	}
	131	p = tmps;
	132	i2d_X509_SIG(&sig, &p);
	133	s = tmps;
	134	}
	135	i = RSA_private_encrypt(i, s, sigret, rsa, RSA_PKCS1_PADDING);
	136	if (i <= 0)
	137	ret = 0;
	138	else
	139	*siglen = i;
3e575651	140
031e5cce SM	141	if (type != NID_md5_sha1) {
	142	OPENSSL_cleanse(tmps, (unsigned int)j + 1);
	143	OPENSSL_free(tmps);
	144	}
	145	return (ret);
b6f94dbe MTL	146	}
b6f94dbe MTL	147
7bf7a6d0	148	/*
031e5cce SM	149	* Check DigestInfo structure does not contain extraneous data by reencoding
031e5cce SM	150	* using DER and checking encoding against original.
7bf7a6d0	151	*/
031e5cce SM	152	static int rsa_check_digestinfo(X509_SIG sig, const unsigned char dinfo,
	153	int dinfolen)
	154	{
	155	unsigned char *der = NULL;
	156	int derlen;
	157	int ret = 0;
	158	derlen = i2d_X509_SIG(sig, &der);
	159	if (derlen <= 0)
	160	return 0;
	161	if (derlen == dinfolen && !memcmp(dinfo, der, derlen))
	162	ret = 1;
	163	OPENSSL_cleanse(der, derlen);
	164	OPENSSL_free(der);
	165	return ret;
	166	}
	167
	168	int int_rsa_verify(int dtype, const unsigned char *m,
	169	unsigned int m_len,
d3819813 MTL	170	unsigned char rm, size_t prm_len,
	171	const unsigned char sigbuf, size_t siglen, RSA rsa)
	172	{
031e5cce SM	173	int i, ret = 0, sigtype;
	174	unsigned char *s;
	175	X509_SIG *sig = NULL;
3e575651	176
031e5cce SM	177	#ifdef OPENSSL_FIPS
	178	if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
	179	&& !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)) {
	180	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_NON_FIPS_RSA_METHOD);
7bf7a6d0	181	return 0;
b6f94dbe	182	}
031e5cce	183	#endif
b6f94dbe	184
031e5cce SM	185	if (siglen != (unsigned int)RSA_size(rsa)) {
	186	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_WRONG_SIGNATURE_LENGTH);
	187	return (0);
	188	}
	189
	190	if ((dtype == NID_md5_sha1) && rm) {
	191	i = RSA_public_decrypt((int)siglen,
	192	sigbuf, rm, rsa, RSA_PKCS1_PADDING);
	193	if (i <= 0)
	194	return 0;
	195	*prm_len = i;
	196	return 1;
	197	}
	198
	199	s = (unsigned char *)OPENSSL_malloc((unsigned int)siglen);
	200	if (s == NULL) {
d3819813 MTL	201	RSAerr(RSA_F_INT_RSA_VERIFY, ERR_R_MALLOC_FAILURE);
	202	goto err;
	203	}
031e5cce SM	204	if ((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH)) {
031e5cce SM	205	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_MESSAGE_LENGTH);
b6f94dbe	206	goto err;
031e5cce SM	207	}
031e5cce SM	208	i = RSA_public_decrypt((int)siglen, sigbuf, s, rsa, RSA_PKCS1_PADDING);
7bf7a6d0	209
031e5cce SM	210	if (i <= 0)
	211	goto err;
	212	/*
	213	* Oddball MDC2 case: signature can be OCTET STRING. check for correct
	214	* tag and length octets.
	215	*/
	216	if (dtype == NID_mdc2 && i == 18 && s[0] == 0x04 && s[1] == 0x10) {
	217	if (rm) {
	218	memcpy(rm, s + 2, 16);
7bf7a6d0	219	*prm_len = 16;
031e5cce SM	220	ret = 1;
	221	} else if (memcmp(m, s + 2, 16)) {
	222	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
7bf7a6d0	223	} else {
031e5cce	224	ret = 1;
7bf7a6d0	225	}
031e5cce SM	226	} else if (dtype == NID_md5_sha1) {
	227	/* Special case: SSL signature */
	228	if ((i != SSL_SIG_LENGTH) \|\| memcmp(s, m, SSL_SIG_LENGTH))
	229	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
	230	else
	231	ret = 1;
7bf7a6d0	232	} else {
031e5cce SM	233	const unsigned char *p = s;
031e5cce SM	234	sig = d2i_X509_SIG(NULL, &p, (long)i);
f4173af1	235
031e5cce	236	if (sig == NULL)
7bf7a6d0	237	goto err;
f4173af1	238
031e5cce SM	239	/* Excess data can be used to create forgeries */
031e5cce SM	240	if (p != s + i \|\| !rsa_check_digestinfo(sig, s, i)) {
7bf7a6d0	241	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
b6f94dbe MTL	242	goto err;
b6f94dbe MTL	243	}
7bf7a6d0	244
031e5cce SM	245	/*
	246	* Parameters to the signature algorithm can also be used to create
	247	* forgeries
	248	*/
	249	if (sig->algor->parameter
	250	&& ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) {
	251	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
	252	goto err;
7bf7a6d0	253	}
7bf7a6d0	254
031e5cce	255	sigtype = OBJ_obj2nid(sig->algor->algorithm);
7bf7a6d0	256
031e5cce SM	257	#ifdef RSA_DEBUG
	258	/* put a backward compatibility flag in EAY */
	259	fprintf(stderr, "in(%s) expect(%s)\n", OBJ_nid2ln(sigtype),
	260	OBJ_nid2ln(dtype));
	261	#endif
	262	if (sigtype != dtype) {
	263	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_ALGORITHM_MISMATCH);
	264	goto err;
	265	}
	266	if (rm) {
	267	const EVP_MD *md;
	268	md = EVP_get_digestbynid(dtype);
	269	if (md && (EVP_MD_size(md) != sig->digest->length))
	270	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_INVALID_DIGEST_LENGTH);
	271	else {
	272	memcpy(rm, sig->digest->data, sig->digest->length);
	273	*prm_len = sig->digest->length;
	274	ret = 1;
	275	}
	276	} else if (((unsigned int)sig->digest->length != m_len) \|\|
	277	(memcmp(m, sig->digest->data, m_len) != 0)) {
	278	RSAerr(RSA_F_INT_RSA_VERIFY, RSA_R_BAD_SIGNATURE);
	279	} else
	280	ret = 1;
	281	}
	282	err:
	283	if (sig != NULL)
	284	X509_SIG_free(sig);
	285	if (s != NULL) {
	286	OPENSSL_cleanse(s, (unsigned int)siglen);
	287	OPENSSL_free(s);
	288	}
	289	return (ret);
d3819813 MTL	290	}
d3819813 MTL	291
031e5cce	292	int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
d3819813 MTL	293	const unsigned char sigbuf, unsigned int siglen, RSA rsa)
	294	{
	295
031e5cce SM	296	if ((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify) {
031e5cce SM	297	return rsa->meth->rsa_verify(dtype, m, m_len, sigbuf, siglen, rsa);
d3819813	298	}
3e575651	299
031e5cce	300	return int_rsa_verify(dtype, m, m_len, NULL, NULL, sigbuf, siglen, rsa);
d3819813	301	}