Commit 137096a7 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Defines and strings for special salt length values, add tests 



Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2236)
parent 3c441c2e

crypto/rsa/rsa_ameth.c

+1 −1
Original line number Diff line number Diff line
@@ -540,7 +540,7 @@ static RSA_PSS_PARAMS *rsa_ctx_to_pss(EVP_PKEY_CTX *pkctx) 
        saltlen = EVP_MD_size(sigmd);

    else if (saltlen == -2) {

        saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;

        if (((EVP_PKEY_bits(pk) - 1) & 0x7) == 0)

        if ((EVP_PKEY_bits(pk) & 0x7) == 1)

            saltlen--;

    }

crypto/rsa/rsa_pmeth.c

+15 −5
Original line number Diff line number Diff line
@@ -58,7 +58,8 @@ static int pkey_rsa_init(EVP_PKEY_CTX *ctx) 
        rctx->pad_mode = RSA_PKCS1_PSS_PADDING;

    else

        rctx->pad_mode = RSA_PKCS1_PADDING;

    rctx->saltlen = -2;

    /* Maximum for sign, auto for verify */

    rctx->saltlen = RSA_PSS_SALTLEN_AUTO;

    rctx->min_saltlen = -1;

    ctx->data = rctx;

    ctx->keygen_info = rctx->gentmp;
@@ -430,14 +431,16 @@ static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) 
        if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {

            *(int *)p2 = rctx->saltlen;

        } else {

            if (p1 < -2)

            if (p1 < RSA_PSS_SALTLEN_MAX)

                return -2;

            if (rsa_pss_restricted(rctx)) {

                if (p1 == -2 && ctx->operation == EVP_PKEY_OP_VERIFY) {

                if (p1 == RSA_PSS_SALTLEN_AUTO

                    && ctx->operation == EVP_PKEY_OP_VERIFY) {

                    RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);

                    return -2;

                }

                if ((p1 == -1 && rctx->min_saltlen > EVP_MD_size(rctx->md))

                if ((p1 == RSA_PSS_SALTLEN_DIGEST

                     && rctx->min_saltlen > EVP_MD_size(rctx->md))

                    || (p1 >= 0 && p1 < rctx->min_saltlen)) {

                    RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL);

                    return 0;
@@ -596,6 +599,13 @@ static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx, 


    if (strcmp(type, "rsa_pss_saltlen") == 0) {

        int saltlen;

        if (!strcmp(value, "digest"))

            saltlen = RSA_PSS_SALTLEN_DIGEST;

        else if (!strcmp(value, "max"))

            saltlen = RSA_PSS_SALTLEN_MAX;

        else if (!strcmp(value, "auto"))

            saltlen = RSA_PSS_SALTLEN_AUTO;

        else

            saltlen = atoi(value);

        return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);

    }

crypto/rsa/rsa_pss.c

+11 −12
Original line number Diff line number Diff line
@@ -41,7 +41,6 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash, 
    EVP_MD_CTX *ctx = EVP_MD_CTX_new();

    unsigned char H_[EVP_MAX_MD_SIZE];





    if (ctx == NULL)

        goto err;
@@ -57,11 +56,9 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash, 
     *      -2      salt length is autorecovered from signature

     *      -N      reserved

     */

    if (sLen == -1)

    if (sLen == RSA_PSS_SALTLEN_DIGEST)

        sLen = hLen;

    else if (sLen == -2)

        sLen = -2;

    else if (sLen < -2) {

    else if (sLen < RSA_PSS_SALTLEN_MAX) {

        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);

        goto err;

    }
@@ -76,7 +73,9 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash, 
        EM++;

        emLen--;

    }

    if (emLen < (hLen + sLen + 2)) { /* sLen can be small negative */

    if (sLen == RSA_PSS_SALTLEN_MAX) {

        sLen = emLen - hLen - 2;

    } else if (emLen < (hLen + sLen + 2)) { /* sLen can be small negative */

        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);

        goto err;

    }
@@ -102,7 +101,7 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash, 
        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);

        goto err;

    }

    if (sLen >= 0 && (maskedDBLen - i) != sLen) {

    if (sLen != RSA_PSS_SALTLEN_AUTO && (maskedDBLen - i) != sLen) {

        RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);

        goto err;

    }
@@ -160,11 +159,11 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM, 
     *      -2      salt length is maximized

     *      -N      reserved

     */

    if (sLen == -1)

    if (sLen == RSA_PSS_SALTLEN_DIGEST)

        sLen = hLen;

    else if (sLen == -2)

        sLen = -2;

    else if (sLen < -2) {

    else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN)

        sLen = RSA_PSS_SALTLEN_MAX;

    else if (sLen < RSA_PSS_SALTLEN_MAX) {

        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);

        goto err;

    }
@@ -175,7 +174,7 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM, 
        *EM++ = 0;

        emLen--;

    }

    if (sLen == -2) {

    if (sLen == RSA_PSS_SALTLEN_MAX) {

        sLen = emLen - hLen - 2;

    } else if (emLen < (hLen + sLen + 2)) {

        RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,

doc/man1/pkeyutl.pod

+5 −5
Original line number Diff line number Diff line
@@ -215,11 +215,11 @@ specified. 


=item B<rsa_pss_saltlen:len>



For B<pss> mode only this option specifies the salt length. Two special values

are supported: -1 sets the salt length to the digest length. When signing -2

sets the salt length to the maximum permissible value. When verifying -2 causes

the salt length to be automatically determined based on the B<PSS> block

structure.

For B<pss> mode only this option specifies the salt length. Three special

values are supported: "digest" sets the salt length to the digest length,

"max" sets the salt length to the maximum permissible value. When verifying

"auto" causes the salt length to be automatically determined based on the

B<PSS> block structure.



=item B<rsa_mgf1_md:digest>

doc/man3/EVP_PKEY_CTX_ctrl.pod

+7 −6
Original line number Diff line number Diff line
@@ -82,12 +82,13 @@ if this control is called. If it is not called then the first byte of the plaint 
buffer is expected to be the algorithm identifier byte.



The EVP_PKEY_CTX_set_rsa_pss_saltlen() macro sets the RSA PSS salt length to

B<len> as its name implies it is only supported for PSS padding.  Two special

values are supported: -1 sets the salt length to the digest length. When

signing -2 sets the salt length to the maximum permissible value. When

verifying -2 causes the salt length to be automatically determined based on the

B<PSS> block structure. If this macro is not called a salt length value of -2

is used by default.

B<len> as its name implies it is only supported for PSS padding.  Three special

values are supported: RSA_PSS_SALTLEN_DIGEST sets the salt length to the

digest length, RSA_PSS_SALTLEN_MAX sets the salt length to the maximum

permissible value. When verifying RSA_PSS_SALTLEN_AUTO causes the salt length

to be automatically determined based on the B<PSS> block structure. If this

macro is not called maximum salt length is used when signing and auto detection

when verifying is used by default.



The EVP_PKEY_CTX_set_rsa_rsa_keygen_bits() macro sets the RSA key length for

RSA key generation to B<bits>. If not specified 1024 bits is used.