CryptoPkg/Library/BaseCryptLib/Pk/CryptRsaExt.c

   1 /** @file
   2   RSA Asymmetric Cipher Wrapper Implementation over OpenSSL.
   3
   4   This file implements following APIs which provide more capabilities for RSA:
   5   1) RsaGetKey
   6   2) RsaGenerateKey
   7   3) RsaCheckKey
   8   4) RsaPkcs1Sign
   9
  10 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
  11 This program and the accompanying materials
  12 are licensed and made available under the terms and conditions of the BSD License
  13 which accompanies this distribution.  The full text of the license may be found at
  14 http://opensource.org/licenses/bsd-license.php
  15
  16 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  17 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  18
  19 **/
  20
  21 #include "InternalCryptLib.h"
  22
  23 #include <openssl/bn.h>
  24 #include <openssl/rsa.h>
  25 #include <openssl/err.h>
  26 #include <openssl/objects.h>
  27
  28 /**
  29   Gets the tag-designated RSA key component from the established RSA context.
  30
  31   This function retrieves the tag-designated RSA key component from the
  32   established RSA context as a non-negative integer (octet string format
  33   represented in RSA PKCS#1).
  34   If specified key component has not been set or has been cleared, then returned
  35   BnSize is set to 0.
  36   If the BigNumber buffer is too small to hold the contents of the key, FALSE
  37   is returned and BnSize is set to the required buffer size to obtain the key.
  38
  39   If RsaContext is NULL, then return FALSE.
  40   If BnSize is NULL, then return FALSE.
  41   If BnSize is large enough but BigNumber is NULL, then return FALSE.
  42
  43   @param[in, out]  RsaContext  Pointer to RSA context being set.
  44   @param[in]       KeyTag      Tag of RSA key component being set.
  45   @param[out]      BigNumber   Pointer to octet integer buffer.
  46   @param[in, out]  BnSize      On input, the size of big number buffer in bytes.
  47                                On output, the size of data returned in big number buffer in bytes.
  48
  49   @retval  TRUE   RSA key component was retrieved successfully.
  50   @retval  FALSE  Invalid RSA key component tag.
  51   @retval  FALSE  BnSize is too small.
  52
  53 **/
  54 BOOLEAN
  55 EFIAPI
  56 RsaGetKey (
  57   IN OUT  VOID         *RsaContext,
  58   IN      RSA_KEY_TAG  KeyTag,
  59   OUT     UINT8        *BigNumber,
  60   IN OUT  UINTN        *BnSize
  61   )
  62 {
  63   RSA    *RsaKey;
  64   BIGNUM *BnKey;
  65   UINTN  Size;
  66
  67   //
  68   // Check input parameters.
  69   //
  70   if (RsaContext == NULL || BnSize == NULL) {
  71     return FALSE;
  72   }
  73
  74   RsaKey  = (RSA *) RsaContext;
  75   Size    = *BnSize;
  76   *BnSize = 0;
  77   BnKey   = NULL;
  78
  79   switch (KeyTag) {
  80
  81   //
  82   // RSA Public Modulus (N)
  83   //
  84   case RsaKeyN:
  85     RSA_get0_key (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL);
  86     break;
  87
  88   //
  89   // RSA Public Exponent (e)
  90   //
  91   case RsaKeyE:
  92     RSA_get0_key (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL);
  93     break;
  94
  95   //
  96   // RSA Private Exponent (d)
  97   //
  98   case RsaKeyD:
  99     RSA_get0_key (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey);
 100     break;
 101
 102   //
 103   // RSA Secret Prime Factor of Modulus (p)
 104   //
 105   case RsaKeyP:
 106     RSA_get0_factors (RsaKey, (const BIGNUM **)&BnKey, NULL);
 107     break;
 108
 109   //
 110   // RSA Secret Prime Factor of Modules (q)
 111   //
 112   case RsaKeyQ:
 113     RSA_get0_factors (RsaKey, NULL, (const BIGNUM **)&BnKey);
 114     break;
 115
 116   //
 117   // p's CRT Exponent (== d mod (p - 1))
 118   //
 119   case RsaKeyDp:
 120     RSA_get0_crt_params (RsaKey, (const BIGNUM **)&BnKey, NULL, NULL);
 121     break;
 122
 123   //
 124   // q's CRT Exponent (== d mod (q - 1))
 125   //
 126   case RsaKeyDq:
 127     RSA_get0_crt_params (RsaKey, NULL, (const BIGNUM **)&BnKey, NULL);
 128     break;
 129
 130   //
 131   // The CRT Coefficient (== 1/q mod p)
 132   //
 133   case RsaKeyQInv:
 134     RSA_get0_crt_params (RsaKey, NULL, NULL, (const BIGNUM **)&BnKey);
 135     break;
 136
 137   default:
 138     return FALSE;
 139   }
 140
 141   if (BnKey == NULL) {
 142     return FALSE;
 143   }
 144
 145   *BnSize = Size;
 146   Size    = BN_num_bytes (BnKey);
 147
 148   if (*BnSize < Size) {
 149     *BnSize = Size;
 150     return FALSE;
 151   }
 152
 153   if (BigNumber == NULL) {
 154     *BnSize = Size;
 155     return TRUE;
 156   }
 157   *BnSize = BN_bn2bin (BnKey, BigNumber) ;
 158
 159   return TRUE;
 160 }
 161
 162 /**
 163   Generates RSA key components.
 164
 165   This function generates RSA key components. It takes RSA public exponent E and
 166   length in bits of RSA modulus N as input, and generates all key components.
 167   If PublicExponent is NULL, the default RSA public exponent (0x10001) will be used.
 168
 169   Before this function can be invoked, pseudorandom number generator must be correctly
 170   initialized by RandomSeed().
 171
 172   If RsaContext is NULL, then return FALSE.
 173
 174   @param[in, out]  RsaContext           Pointer to RSA context being set.
 175   @param[in]       ModulusLength        Length of RSA modulus N in bits.
 176   @param[in]       PublicExponent       Pointer to RSA public exponent.
 177   @param[in]       PublicExponentSize   Size of RSA public exponent buffer in bytes.
 178
 179   @retval  TRUE   RSA key component was generated successfully.
 180   @retval  FALSE  Invalid RSA key component tag.
 181
 182 **/
 183 BOOLEAN
 184 EFIAPI
 185 RsaGenerateKey (
 186   IN OUT  VOID         *RsaContext,
 187   IN      UINTN        ModulusLength,
 188   IN      CONST UINT8  *PublicExponent,
 189   IN      UINTN        PublicExponentSize
 190   )
 191 {
 192   BIGNUM   *KeyE;
 193   BOOLEAN  RetVal;
 194
 195   //
 196   // Check input parameters.
 197   //
 198   if (RsaContext == NULL || ModulusLength > INT_MAX || PublicExponentSize > INT_MAX) {
 199     return FALSE;
 200   }
 201
 202   KeyE = BN_new ();
 203   if (KeyE == NULL) {
 204     return FALSE;
 205   }
 206
 207   RetVal = FALSE;
 208
 209   if (PublicExponent == NULL) {
 210     if (BN_set_word (KeyE, 0x10001) == 0) {
 211       goto _Exit;
 212     }
 213   } else {
 214     if (BN_bin2bn (PublicExponent, (UINT32) PublicExponentSize, KeyE) == NULL) {
 215       goto _Exit;
 216     }
 217   }
 218
 219   if (RSA_generate_key_ex ((RSA *) RsaContext, (UINT32) ModulusLength, KeyE, NULL) == 1) {
 220    RetVal = TRUE;
 221   }
 222
 223 _Exit:
 224   BN_free (KeyE);
 225   return RetVal;
 226 }
 227
 228 /**
 229   Validates key components of RSA context.
 230   NOTE: This function performs integrity checks on all the RSA key material, so
 231         the RSA key structure must contain all the private key data.
 232
 233   This function validates key components of RSA context in following aspects:
 234   - Whether p is a prime
 235   - Whether q is a prime
 236   - Whether n = p * q
 237   - Whether d*e = 1  mod lcm(p-1,q-1)
 238
 239   If RsaContext is NULL, then return FALSE.
 240
 241   @param[in]  RsaContext  Pointer to RSA context to check.
 242
 243   @retval  TRUE   RSA key components are valid.
 244   @retval  FALSE  RSA key components are not valid.
 245
 246 **/
 247 BOOLEAN
 248 EFIAPI
 249 RsaCheckKey (
 250   IN  VOID  *RsaContext
 251   )
 252 {
 253   UINTN  Reason;
 254
 255   //
 256   // Check input parameters.
 257   //
 258   if (RsaContext == NULL) {
 259     return FALSE;
 260   }
 261
 262   if  (RSA_check_key ((RSA *) RsaContext) != 1) {
 263     Reason = ERR_GET_REASON (ERR_peek_last_error ());
 264     if (Reason == RSA_R_P_NOT_PRIME ||
 265         Reason == RSA_R_Q_NOT_PRIME ||
 266         Reason == RSA_R_N_DOES_NOT_EQUAL_P_Q ||
 267         Reason == RSA_R_D_E_NOT_CONGRUENT_TO_1) {
 268       return FALSE;
 269     }
 270   }
 271
 272   return TRUE;
 273 }
 274
 275 /**
 276   Carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme.
 277
 278   This function carries out the RSA-SSA signature generation with EMSA-PKCS1-v1_5 encoding scheme defined in
 279   RSA PKCS#1.
 280   If the Signature buffer is too small to hold the contents of signature, FALSE
 281   is returned and SigSize is set to the required buffer size to obtain the signature.
 282
 283   If RsaContext is NULL, then return FALSE.
 284   If MessageHash is NULL, then return FALSE.
 285   If HashSize is not equal to the size of MD5, SHA-1 or SHA-256 digest, then return FALSE.
 286   If SigSize is large enough but Signature is NULL, then return FALSE.
 287
 288   @param[in]       RsaContext   Pointer to RSA context for signature generation.
 289   @param[in]       MessageHash  Pointer to octet message hash to be signed.
 290   @param[in]       HashSize     Size of the message hash in bytes.
 291   @param[out]      Signature    Pointer to buffer to receive RSA PKCS1-v1_5 signature.
 292   @param[in, out]  SigSize      On input, the size of Signature buffer in bytes.
 293                                 On output, the size of data returned in Signature buffer in bytes.
 294
 295   @retval  TRUE   Signature successfully generated in PKCS1-v1_5.
 296   @retval  FALSE  Signature generation failed.
 297   @retval  FALSE  SigSize is too small.
 298
 299 **/
 300 BOOLEAN
 301 EFIAPI
 302 RsaPkcs1Sign (
 303   IN      VOID         *RsaContext,
 304   IN      CONST UINT8  *MessageHash,
 305   IN      UINTN        HashSize,
 306   OUT     UINT8        *Signature,
 307   IN OUT  UINTN        *SigSize
 308   )
 309 {
 310   RSA      *Rsa;
 311   UINTN    Size;
 312   INT32    DigestType;
 313
 314   //
 315   // Check input parameters.
 316   //
 317   if (RsaContext == NULL || MessageHash == NULL) {
 318     return FALSE;
 319   }
 320
 321   Rsa = (RSA *) RsaContext;
 322   Size = RSA_size (Rsa);
 323
 324   if (*SigSize < Size) {
 325     *SigSize = Size;
 326     return FALSE;
 327   }
 328
 329   if (Signature == NULL) {
 330     return FALSE;
 331   }
 332
 333   //
 334   // Determine the message digest algorithm according to digest size.
 335   //   Only MD5, SHA-1 or SHA-256 algorithm is supported.
 336   //
 337   switch (HashSize) {
 338   case MD5_DIGEST_SIZE:
 339     DigestType = NID_md5;
 340     break;
 341
 342   case SHA1_DIGEST_SIZE:
 343     DigestType = NID_sha1;
 344     break;
 345
 346   case SHA256_DIGEST_SIZE:
 347     DigestType = NID_sha256;
 348     break;
 349
 350   default:
 351     return FALSE;
 352   }
 353
 354   return (BOOLEAN) RSA_sign (
 355                      DigestType,
 356                      MessageHash,
 357                      (UINT32) HashSize,
 358                      Signature,
 359                      (UINT32 *) SigSize,
 360                      (RSA *) RsaContext
 361                      );
 362 }