Commit a7113d64 authored by Bodo Möller's avatar Bodo Möller
Browse files

improve OAEP check

parent 3f345dc6

CHANGES

+7 −0
Original line number Diff line number Diff line
@@ -4,6 +4,13 @@ 


 Changes between 0.9.6b and 0.9.6c  [XX xxx XXXX]



  *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid

     'wristwatch attack' using huge encoding parameters (cf.

     James H. Manger's CRYPTO 2001 paper).  Note that the

     RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use

     encoding paramters and hence was not vulnerable.

     [Bodo Moeller]



  *) BN_sqr() bug fix.

     [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]

crypto/rsa/rsa_oaep.c

+157 −125
Original line number Diff line number Diff line
@@ -2,7 +2,22 @@ 
/* Written by Ulf Moeller. This software is distributed on an "AS IS"

   basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. */



/* EME_OAEP as defined in RFC 2437 (PKCS #1 v2.0) */

/* EME-OAEP as defined in RFC 2437 (PKCS #1 v2.0) */



/* See Victor Shoup, "OAEP reconsidered," Nov. 2000,

 * <URL: http://www.shoup.net/papers/oaep.ps.Z>

 * for problems with the security proof for the

 * original OAEP scheme, which EME-OAEP is based on.

 * 

 * A new proof can be found in E. Fujisaki, T. Okamoto,

 * D. Pointcheval, J. Stern, "RSA-OEAP is Still Alive!",

 * Dec. 2000, <URL: http://eprint.iacr.org/2000/061/>.

 * The new proof has stronger requirements for the

 * underlying permutation: "partial-one-wayness" instead

 * of one-wayness.  For the RSA function, this is

 * an equivalent notion.

 */





#if !defined(NO_SHA) && !defined(NO_SHA1)

#include <stdio.h>
@@ -12,10 +27,12 @@ 
#include <openssl/sha.h>

#include <openssl/rand.h>



int MGF1(unsigned char *mask, long len, unsigned char *seed, long seedlen);

int MGF1(unsigned char *mask, long len,

	unsigned char *seed, long seedlen);



int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,

	     unsigned char *from, int flen, unsigned char *param, int plen)

	unsigned char *from, int flen,

	unsigned char *param, int plen)

	{

	int i, emlen = tlen - 1;

	unsigned char *db, *seed;
@@ -25,20 +42,20 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, 
		{

		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP,

		   RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);

	return (0);

		return 0;

		}



	if (emlen < 2 * SHA_DIGEST_LENGTH + 1)

		{

		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);

	return (0);

		return 0;

		}



	dbmask = OPENSSL_malloc(emlen - SHA_DIGEST_LENGTH);

	if (dbmask == NULL)

		{

		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);

	return (0);

		return 0;

		}



	to[0] = 0;
@@ -51,7 +68,7 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, 
	db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;

	memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, (unsigned int) flen);

	if (RAND_bytes(seed, SHA_DIGEST_LENGTH) <= 0)

    	return (0);

		return 0;

#ifdef PKCS_TESTVECT

	memcpy(seed,

	   "\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2\xf0\x6c\xb5\x8f",
@@ -67,7 +84,7 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, 
		seed[i] ^= seedmask[i];



	OPENSSL_free(dbmask);

    return (1);

	return 1;

	}



int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
@@ -78,13 +95,26 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, 
	unsigned char *maskeddb;

	int lzero;

	unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];

	int bad = 0;



	if (--num < 2 * SHA_DIGEST_LENGTH + 1)

		/* 'num' is the length of the modulus, i.e. does not depend on the

		 * particular ciphertext. */

		goto decoding_err;



	lzero = num - flen;

	if (lzero < 0)

	goto decoding_err;

		{

		/* lzero == -1 */



		/* signalling this error immediately after detection might allow

		 * for side-channel attacks (e.g. timing if 'plen' is huge

		 * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA Optimal

		 * Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001),

		 * so we use a 'bad' flag */

		bad = 1;

		lzero = 0;

		}

	maskeddb = from - lzero + SHA_DIGEST_LENGTH;



	dblen = num - SHA_DIGEST_LENGTH;
@@ -92,7 +122,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, 
	if (db == NULL)

		{

		RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);

	return (-1);

		return -1;

		}



	MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);
@@ -105,7 +135,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, 


	SHA1(param, plen, phash);



    if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0)

	if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)

		goto decoding_err;

	else

		{
@@ -116,6 +146,8 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, 
			goto decoding_err;

		else

			{

			/* everything looks OK */



			mlen = dblen - i;

			if (tlen < mlen)

				{
@@ -127,7 +159,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, 
			}

		}

	OPENSSL_free(db);

    return (mlen);

	return mlen;



decoding_err:

	/* to avoid chosen ciphertext attacks, the error message should not reveal
@@ -163,6 +195,6 @@ int MGF1(unsigned char *mask, long len, unsigned char *seed, long seedlen) 
			outlen = len;

			}

		}

    return (0);

	return 0;

	}

#endif