Defines and strings for special salt length values, add tests (137096a7) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

crypto/rsa/rsa_ameth.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -540,7 +540,7 @@ static RSA_PSS_PARAMS rsa_ctx_to_pss(EVP_PKEY_CTX pkctx)
	saltlen = EVP_MD_size(sigmd);		saltlen = EVP_MD_size(sigmd);
	else if (saltlen == -2) {		else if (saltlen == -2) {
	saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;		saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;
	if (((EVP_PKEY_bits(pk) - 1) & 0x7) == 0)		if ((EVP_PKEY_bits(pk) & 0x7) == 1)
	saltlen--;		saltlen--;
	}		}

crypto/rsa/rsa_pmeth.c

+15 −5

Original line number	Original line	Diff line number	Diff line
	@@ -58,7 +58,8 @@ static int pkey_rsa_init(EVP_PKEY_CTX *ctx)
	rctx->pad_mode = RSA_PKCS1_PSS_PADDING;		rctx->pad_mode = RSA_PKCS1_PSS_PADDING;
	else		else
	rctx->pad_mode = RSA_PKCS1_PADDING;		rctx->pad_mode = RSA_PKCS1_PADDING;
	rctx->saltlen = -2;		/* Maximum for sign, auto for verify */
			rctx->saltlen = RSA_PSS_SALTLEN_AUTO;
	rctx->min_saltlen = -1;		rctx->min_saltlen = -1;
	ctx->data = rctx;		ctx->data = rctx;
	ctx->keygen_info = rctx->gentmp;		ctx->keygen_info = rctx->gentmp;
	@@ -430,14 +431,16 @@ static int pkey_rsa_ctrl(EVP_PKEY_CTX ctx, int type, int p1, void p2)
	if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {		if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) {
	(int )p2 = rctx->saltlen;		(int )p2 = rctx->saltlen;
	} else {		} else {
	if (p1 < -2)		if (p1 < RSA_PSS_SALTLEN_MAX)
	return -2;		return -2;
	if (rsa_pss_restricted(rctx)) {		if (rsa_pss_restricted(rctx)) {
	if (p1 == -2 && ctx->operation == EVP_PKEY_OP_VERIFY) {		if (p1 == RSA_PSS_SALTLEN_AUTO
			&& ctx->operation == EVP_PKEY_OP_VERIFY) {
	RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);		RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN);
	return -2;		return -2;
	}		}
	if ((p1 == -1 && rctx->min_saltlen > EVP_MD_size(rctx->md))		if ((p1 == RSA_PSS_SALTLEN_DIGEST
			&& rctx->min_saltlen > EVP_MD_size(rctx->md))
	\|\| (p1 >= 0 && p1 < rctx->min_saltlen)) {		\|\| (p1 >= 0 && p1 < rctx->min_saltlen)) {
	RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL);		RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL);
	return 0;		return 0;
	@@ -596,6 +599,13 @@ static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,

	if (strcmp(type, "rsa_pss_saltlen") == 0) {		if (strcmp(type, "rsa_pss_saltlen") == 0) {
	int saltlen;		int saltlen;
			if (!strcmp(value, "digest"))
			saltlen = RSA_PSS_SALTLEN_DIGEST;
			else if (!strcmp(value, "max"))
			saltlen = RSA_PSS_SALTLEN_MAX;
			else if (!strcmp(value, "auto"))
			saltlen = RSA_PSS_SALTLEN_AUTO;
			else
	saltlen = atoi(value);		saltlen = atoi(value);
	return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);		return EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, saltlen);
	}		}

crypto/rsa/rsa_pss.c

+11 −12

Original line number	Original line	Diff line number	Diff line
	@@ -41,7 +41,6 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA rsa, const unsigned char mHash,
	EVP_MD_CTX *ctx = EVP_MD_CTX_new();		EVP_MD_CTX *ctx = EVP_MD_CTX_new();
	unsigned char H_[EVP_MAX_MD_SIZE];		unsigned char H_[EVP_MAX_MD_SIZE];


	if (ctx == NULL)		if (ctx == NULL)
	goto err;		goto err;

	@@ -57,11 +56,9 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA rsa, const unsigned char mHash,
	* -2 salt length is autorecovered from signature		* -2 salt length is autorecovered from signature
	* -N reserved		* -N reserved
	*/		*/
	if (sLen == -1)		if (sLen == RSA_PSS_SALTLEN_DIGEST)
	sLen = hLen;		sLen = hLen;
	else if (sLen == -2)		else if (sLen < RSA_PSS_SALTLEN_MAX) {
	sLen = -2;
	else if (sLen < -2) {
	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);		RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	goto err;		goto err;
	}		}
	@@ -76,7 +73,9 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA rsa, const unsigned char mHash,
	EM++;		EM++;
	emLen--;		emLen--;
	}		}
	if (emLen < (hLen + sLen + 2)) { /* sLen can be small negative */		if (sLen == RSA_PSS_SALTLEN_MAX) {
			sLen = emLen - hLen - 2;
			} else if (emLen < (hLen + sLen + 2)) { /* sLen can be small negative */
	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);		RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_DATA_TOO_LARGE);
	goto err;		goto err;
	}		}
	@@ -102,7 +101,7 @@ int RSA_verify_PKCS1_PSS_mgf1(RSA rsa, const unsigned char mHash,
	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);		RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_RECOVERY_FAILED);
	goto err;		goto err;
	}		}
	if (sLen >= 0 && (maskedDBLen - i) != sLen) {		if (sLen != RSA_PSS_SALTLEN_AUTO && (maskedDBLen - i) != sLen) {
	RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);		RSAerr(RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	goto err;		goto err;
	}		}
	@@ -160,11 +159,11 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA rsa, unsigned char EM,
	* -2 salt length is maximized		* -2 salt length is maximized
	* -N reserved		* -N reserved
	*/		*/
	if (sLen == -1)		if (sLen == RSA_PSS_SALTLEN_DIGEST)
	sLen = hLen;		sLen = hLen;
	else if (sLen == -2)		else if (sLen == RSA_PSS_SALTLEN_MAX_SIGN)
	sLen = -2;		sLen = RSA_PSS_SALTLEN_MAX;
	else if (sLen < -2) {		else if (sLen < RSA_PSS_SALTLEN_MAX) {
	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1, RSA_R_SLEN_CHECK_FAILED);
	goto err;		goto err;
	}		}
	@@ -175,7 +174,7 @@ int RSA_padding_add_PKCS1_PSS_mgf1(RSA rsa, unsigned char EM,
	*EM++ = 0;		*EM++ = 0;
	emLen--;		emLen--;
	}		}
	if (sLen == -2) {		if (sLen == RSA_PSS_SALTLEN_MAX) {
	sLen = emLen - hLen - 2;		sLen = emLen - hLen - 2;
	} else if (emLen < (hLen + sLen + 2)) {		} else if (emLen < (hLen + sLen + 2)) {
	RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1,

doc/man1/pkeyutl.pod

+5 −5

Original line number	Original line	Diff line number	Diff line
	@@ -215,11 +215,11 @@ specified.

	=item B<rsa_pss_saltlen:len>		=item B<rsa_pss_saltlen:len>

	For B<pss> mode only this option specifies the salt length. Two special values		For B<pss> mode only this option specifies the salt length. Three special
	are supported: -1 sets the salt length to the digest length. When signing -2		values are supported: "digest" sets the salt length to the digest length,
	sets the salt length to the maximum permissible value. When verifying -2 causes		"max" sets the salt length to the maximum permissible value. When verifying
	the salt length to be automatically determined based on the B<PSS> block		"auto" causes the salt length to be automatically determined based on the
	structure.		B<PSS> block structure.

	=item B<rsa_mgf1_md:digest>		=item B<rsa_mgf1_md:digest>

doc/man3/EVP_PKEY_CTX_ctrl.pod

+7 −6

Original line number	Original line	Diff line number	Diff line
	@@ -82,12 +82,13 @@ if this control is called. If it is not called then the first byte of the plaint
	buffer is expected to be the algorithm identifier byte.		buffer is expected to be the algorithm identifier byte.

	The EVP_PKEY_CTX_set_rsa_pss_saltlen() macro sets the RSA PSS salt length to		The EVP_PKEY_CTX_set_rsa_pss_saltlen() macro sets the RSA PSS salt length to
	B<len> as its name implies it is only supported for PSS padding. Two special		B<len> as its name implies it is only supported for PSS padding. Three special
	values are supported: -1 sets the salt length to the digest length. When		values are supported: RSA_PSS_SALTLEN_DIGEST sets the salt length to the
	signing -2 sets the salt length to the maximum permissible value. When		digest length, RSA_PSS_SALTLEN_MAX sets the salt length to the maximum
	verifying -2 causes the salt length to be automatically determined based on the		permissible value. When verifying RSA_PSS_SALTLEN_AUTO causes the salt length
	B<PSS> block structure. If this macro is not called a salt length value of -2		to be automatically determined based on the B<PSS> block structure. If this
	is used by default.		macro is not called maximum salt length is used when signing and auto detection
			when verifying is used by default.

	The EVP_PKEY_CTX_set_rsa_rsa_keygen_bits() macro sets the RSA key length for		The EVP_PKEY_CTX_set_rsa_rsa_keygen_bits() macro sets the RSA key length for
	RSA key generation to B<bits>. If not specified 1024 bits is used.		RSA key generation to B<bits>. If not specified 1024 bits is used.