450 lines
13 KiB
C
450 lines
13 KiB
C
/*
|
|
* Copyright 2018-2023 The OpenSSL Project Authors. All Rights Reserved.
|
|
* Copyright (c) 2018-2019, Oracle and/or its affiliates. All rights reserved.
|
|
*
|
|
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
* in the file LICENSE in the source distribution or at
|
|
* https://www.openssl.org/source/license.html
|
|
*/
|
|
|
|
#include <openssl/err.h>
|
|
#include <openssl/bn.h>
|
|
#include <openssl/core.h>
|
|
#include <openssl/evp.h>
|
|
#include <openssl/rand.h>
|
|
#include "crypto/bn.h"
|
|
#include "crypto/security_bits.h"
|
|
#include "rsa_local.h"
|
|
|
|
#define RSA_FIPS1864_MIN_KEYGEN_KEYSIZE 2048
|
|
#define RSA_FIPS1864_MIN_KEYGEN_STRENGTH 112
|
|
|
|
/*
|
|
* Generate probable primes 'p' & 'q'. See FIPS 186-4 Section B.3.6
|
|
* "Generation of Probable Primes with Conditions Based on Auxiliary Probable
|
|
* Primes".
|
|
*
|
|
* Params:
|
|
* rsa Object used to store primes p & q.
|
|
* test Object used for CAVS testing only.that contains..
|
|
* p1, p2 The returned auxiliary primes for p.
|
|
* If NULL they are not returned.
|
|
* Xpout An optionally returned random number used during generation of p.
|
|
* Xp An optional passed in value (that is random number used during
|
|
* generation of p).
|
|
* Xp1, Xp2 Optionally passed in randomly generated numbers from which
|
|
* auxiliary primes p1 & p2 are calculated. If NULL these values
|
|
* are generated internally.
|
|
* q1, q2 The returned auxiliary primes for q.
|
|
* If NULL they are not returned.
|
|
* Xqout An optionally returned random number used during generation of q.
|
|
* Xq An optional passed in value (that is random number used during
|
|
* generation of q).
|
|
* Xq1, Xq2 Optionally passed in randomly generated numbers from which
|
|
* auxiliary primes q1 & q2 are calculated. If NULL these values
|
|
* are generated internally.
|
|
* nbits The key size in bits (The size of the modulus n).
|
|
* e The public exponent.
|
|
* ctx A BN_CTX object.
|
|
* cb An optional BIGNUM callback.
|
|
* Returns: 1 if successful, or 0 otherwise.
|
|
* Notes:
|
|
* p1, p2, q1, q2, Xpout, Xqout are returned if they are not NULL.
|
|
* Xp, Xp1, Xp2, Xq, Xq1, Xq2 are optionally passed in.
|
|
* (Required for CAVS testing).
|
|
*/
|
|
int ossl_rsa_fips186_4_gen_prob_primes(RSA *rsa, RSA_ACVP_TEST *test,
|
|
int nbits, const BIGNUM *e, BN_CTX *ctx,
|
|
BN_GENCB *cb)
|
|
{
|
|
int ret = 0, ok;
|
|
/* Temp allocated BIGNUMS */
|
|
BIGNUM *Xpo = NULL, *Xqo = NULL, *tmp = NULL;
|
|
/* Intermediate BIGNUMS that can be returned for testing */
|
|
BIGNUM *p1 = NULL, *p2 = NULL;
|
|
BIGNUM *q1 = NULL, *q2 = NULL;
|
|
/* Intermediate BIGNUMS that can be input for testing */
|
|
BIGNUM *Xpout = NULL, *Xqout = NULL;
|
|
BIGNUM *Xp = NULL, *Xp1 = NULL, *Xp2 = NULL;
|
|
BIGNUM *Xq = NULL, *Xq1 = NULL, *Xq2 = NULL;
|
|
|
|
#if defined(FIPS_MODULE) && !defined(OPENSSL_NO_ACVP_TESTS)
|
|
if (test != NULL) {
|
|
Xp1 = test->Xp1;
|
|
Xp2 = test->Xp2;
|
|
Xq1 = test->Xq1;
|
|
Xq2 = test->Xq2;
|
|
Xp = test->Xp;
|
|
Xq = test->Xq;
|
|
p1 = test->p1;
|
|
p2 = test->p2;
|
|
q1 = test->q1;
|
|
q2 = test->q2;
|
|
}
|
|
#endif
|
|
|
|
/* (Step 1) Check key length
|
|
* NOTE: SP800-131A Rev1 Disallows key lengths of < 2048 bits for RSA
|
|
* Signature Generation and Key Agree/Transport.
|
|
*/
|
|
if (nbits < RSA_FIPS1864_MIN_KEYGEN_KEYSIZE) {
|
|
ERR_raise(ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL);
|
|
return 0;
|
|
}
|
|
|
|
if (!ossl_rsa_check_public_exponent(e)) {
|
|
ERR_raise(ERR_LIB_RSA, RSA_R_PUB_EXPONENT_OUT_OF_RANGE);
|
|
return 0;
|
|
}
|
|
|
|
/* (Step 3) Determine strength and check rand generator strength is ok -
|
|
* this step is redundant because the generator always returns a higher
|
|
* strength than is required.
|
|
*/
|
|
|
|
BN_CTX_start(ctx);
|
|
tmp = BN_CTX_get(ctx);
|
|
Xpo = (Xpout != NULL) ? Xpout : BN_CTX_get(ctx);
|
|
Xqo = (Xqout != NULL) ? Xqout : BN_CTX_get(ctx);
|
|
if (tmp == NULL || Xpo == NULL || Xqo == NULL)
|
|
goto err;
|
|
BN_set_flags(Xpo, BN_FLG_CONSTTIME);
|
|
BN_set_flags(Xqo, BN_FLG_CONSTTIME);
|
|
|
|
if (rsa->p == NULL)
|
|
rsa->p = BN_secure_new();
|
|
if (rsa->q == NULL)
|
|
rsa->q = BN_secure_new();
|
|
if (rsa->p == NULL || rsa->q == NULL)
|
|
goto err;
|
|
BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
|
|
BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
|
|
|
|
/* (Step 4) Generate p, Xp */
|
|
if (!ossl_bn_rsa_fips186_4_gen_prob_primes(rsa->p, Xpo, p1, p2, Xp, Xp1, Xp2,
|
|
nbits, e, ctx, cb))
|
|
goto err;
|
|
for (;;) {
|
|
/* (Step 5) Generate q, Xq*/
|
|
if (!ossl_bn_rsa_fips186_4_gen_prob_primes(rsa->q, Xqo, q1, q2, Xq, Xq1,
|
|
Xq2, nbits, e, ctx, cb))
|
|
goto err;
|
|
|
|
/* (Step 6) |Xp - Xq| > 2^(nbitlen/2 - 100) */
|
|
ok = ossl_rsa_check_pminusq_diff(tmp, Xpo, Xqo, nbits);
|
|
if (ok < 0)
|
|
goto err;
|
|
if (ok == 0)
|
|
continue;
|
|
|
|
/* (Step 6) |p - q| > 2^(nbitlen/2 - 100) */
|
|
ok = ossl_rsa_check_pminusq_diff(tmp, rsa->p, rsa->q, nbits);
|
|
if (ok < 0)
|
|
goto err;
|
|
if (ok == 0)
|
|
continue;
|
|
break; /* successfully finished */
|
|
}
|
|
rsa->dirty_cnt++;
|
|
ret = 1;
|
|
err:
|
|
/* Zeroize any internally generated values that are not returned */
|
|
if (Xpo != Xpout)
|
|
BN_clear(Xpo);
|
|
if (Xqo != Xqout)
|
|
BN_clear(Xqo);
|
|
BN_clear(tmp);
|
|
|
|
BN_CTX_end(ctx);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Validates the RSA key size based on the target strength.
|
|
* See SP800-56Br1 6.3.1.1 (Steps 1a-1b)
|
|
*
|
|
* Params:
|
|
* nbits The key size in bits.
|
|
* strength The target strength in bits. -1 means the target
|
|
* strength is unknown.
|
|
* Returns: 1 if the key size matches the target strength, or 0 otherwise.
|
|
*/
|
|
int ossl_rsa_sp800_56b_validate_strength(int nbits, int strength)
|
|
{
|
|
int s = (int)ossl_ifc_ffc_compute_security_bits(nbits);
|
|
|
|
#ifdef FIPS_MODULE
|
|
if (s < RSA_FIPS1864_MIN_KEYGEN_STRENGTH) {
|
|
ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_MODULUS);
|
|
return 0;
|
|
}
|
|
#endif
|
|
if (strength != -1 && s != strength) {
|
|
ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_STRENGTH);
|
|
return 0;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
/*
|
|
* Validate that the random bit generator is of sufficient strength to generate
|
|
* a key of the specified length.
|
|
*/
|
|
static int rsa_validate_rng_strength(EVP_RAND_CTX *rng, int nbits)
|
|
{
|
|
if (rng == NULL)
|
|
return 0;
|
|
#ifdef FIPS_MODULE
|
|
/*
|
|
* This should become mainstream once similar tests are added to the other
|
|
* key generations and once there is a way to disable these checks.
|
|
*/
|
|
if (EVP_RAND_get_strength(rng) < ossl_ifc_ffc_compute_security_bits(nbits)) {
|
|
ERR_raise(ERR_LIB_RSA,
|
|
RSA_R_RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT);
|
|
return 0;
|
|
}
|
|
#endif
|
|
return 1;
|
|
}
|
|
|
|
/*
|
|
*
|
|
* Using p & q, calculate other required parameters such as n, d.
|
|
* as well as the CRT parameters dP, dQ, qInv.
|
|
*
|
|
* See SP800-56Br1
|
|
* 6.3.1.1 rsakpg1 - basic (Steps 3-4)
|
|
* 6.3.1.3 rsakpg1 - crt (Step 5)
|
|
*
|
|
* Params:
|
|
* rsa An rsa object.
|
|
* nbits The key size.
|
|
* e The public exponent.
|
|
* ctx A BN_CTX object.
|
|
* Notes:
|
|
* There is a small chance that the generated d will be too small.
|
|
* Returns: -1 = error,
|
|
* 0 = d is too small,
|
|
* 1 = success.
|
|
*/
|
|
int ossl_rsa_sp800_56b_derive_params_from_pq(RSA *rsa, int nbits,
|
|
const BIGNUM *e, BN_CTX *ctx)
|
|
{
|
|
int ret = -1;
|
|
BIGNUM *p1, *q1, *lcm, *p1q1, *gcd;
|
|
|
|
BN_CTX_start(ctx);
|
|
p1 = BN_CTX_get(ctx);
|
|
q1 = BN_CTX_get(ctx);
|
|
lcm = BN_CTX_get(ctx);
|
|
p1q1 = BN_CTX_get(ctx);
|
|
gcd = BN_CTX_get(ctx);
|
|
if (gcd == NULL)
|
|
goto err;
|
|
|
|
BN_set_flags(p1, BN_FLG_CONSTTIME);
|
|
BN_set_flags(q1, BN_FLG_CONSTTIME);
|
|
BN_set_flags(lcm, BN_FLG_CONSTTIME);
|
|
BN_set_flags(p1q1, BN_FLG_CONSTTIME);
|
|
BN_set_flags(gcd, BN_FLG_CONSTTIME);
|
|
|
|
/* LCM((p-1, q-1)) */
|
|
if (ossl_rsa_get_lcm(ctx, rsa->p, rsa->q, lcm, gcd, p1, q1, p1q1) != 1)
|
|
goto err;
|
|
|
|
/* copy e */
|
|
BN_free(rsa->e);
|
|
rsa->e = BN_dup(e);
|
|
if (rsa->e == NULL)
|
|
goto err;
|
|
|
|
BN_clear_free(rsa->d);
|
|
/* (Step 3) d = (e^-1) mod (LCM(p-1, q-1)) */
|
|
rsa->d = BN_secure_new();
|
|
if (rsa->d == NULL)
|
|
goto err;
|
|
BN_set_flags(rsa->d, BN_FLG_CONSTTIME);
|
|
if (BN_mod_inverse(rsa->d, e, lcm, ctx) == NULL)
|
|
goto err;
|
|
|
|
/* (Step 3) return an error if d is too small */
|
|
if (BN_num_bits(rsa->d) <= (nbits >> 1)) {
|
|
ret = 0;
|
|
goto err;
|
|
}
|
|
|
|
/* (Step 4) n = pq */
|
|
if (rsa->n == NULL)
|
|
rsa->n = BN_new();
|
|
if (rsa->n == NULL || !BN_mul(rsa->n, rsa->p, rsa->q, ctx))
|
|
goto err;
|
|
|
|
/* (Step 5a) dP = d mod (p-1) */
|
|
if (rsa->dmp1 == NULL)
|
|
rsa->dmp1 = BN_secure_new();
|
|
if (rsa->dmp1 == NULL)
|
|
goto err;
|
|
BN_set_flags(rsa->dmp1, BN_FLG_CONSTTIME);
|
|
if (!BN_mod(rsa->dmp1, rsa->d, p1, ctx))
|
|
goto err;
|
|
|
|
/* (Step 5b) dQ = d mod (q-1) */
|
|
if (rsa->dmq1 == NULL)
|
|
rsa->dmq1 = BN_secure_new();
|
|
if (rsa->dmq1 == NULL)
|
|
goto err;
|
|
BN_set_flags(rsa->dmq1, BN_FLG_CONSTTIME);
|
|
if (!BN_mod(rsa->dmq1, rsa->d, q1, ctx))
|
|
goto err;
|
|
|
|
/* (Step 5c) qInv = (inverse of q) mod p */
|
|
BN_free(rsa->iqmp);
|
|
rsa->iqmp = BN_secure_new();
|
|
if (rsa->iqmp == NULL)
|
|
goto err;
|
|
BN_set_flags(rsa->iqmp, BN_FLG_CONSTTIME);
|
|
if (BN_mod_inverse(rsa->iqmp, rsa->q, rsa->p, ctx) == NULL)
|
|
goto err;
|
|
|
|
rsa->dirty_cnt++;
|
|
ret = 1;
|
|
err:
|
|
if (ret != 1) {
|
|
BN_free(rsa->e);
|
|
rsa->e = NULL;
|
|
BN_free(rsa->d);
|
|
rsa->d = NULL;
|
|
BN_free(rsa->n);
|
|
rsa->n = NULL;
|
|
BN_free(rsa->iqmp);
|
|
rsa->iqmp = NULL;
|
|
BN_free(rsa->dmq1);
|
|
rsa->dmq1 = NULL;
|
|
BN_free(rsa->dmp1);
|
|
rsa->dmp1 = NULL;
|
|
}
|
|
BN_clear(p1);
|
|
BN_clear(q1);
|
|
BN_clear(lcm);
|
|
BN_clear(p1q1);
|
|
BN_clear(gcd);
|
|
|
|
BN_CTX_end(ctx);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Generate a SP800-56B RSA key.
|
|
*
|
|
* See SP800-56Br1 6.3.1 "RSA Key-Pair Generation with a Fixed Public Exponent"
|
|
* 6.3.1.1 rsakpg1 - basic
|
|
* 6.3.1.3 rsakpg1 - crt
|
|
*
|
|
* See also FIPS 186-4 Section B.3.6
|
|
* "Generation of Probable Primes with Conditions Based on Auxiliary
|
|
* Probable Primes."
|
|
*
|
|
* Params:
|
|
* rsa The rsa object.
|
|
* nbits The intended key size in bits.
|
|
* efixed The public exponent. If NULL a default of 65537 is used.
|
|
* cb An optional BIGNUM callback.
|
|
* Returns: 1 if successfully generated otherwise it returns 0.
|
|
*/
|
|
int ossl_rsa_sp800_56b_generate_key(RSA *rsa, int nbits, const BIGNUM *efixed,
|
|
BN_GENCB *cb)
|
|
{
|
|
int ret = 0;
|
|
int ok;
|
|
BN_CTX *ctx = NULL;
|
|
BIGNUM *e = NULL;
|
|
RSA_ACVP_TEST *info = NULL;
|
|
BIGNUM *tmp;
|
|
|
|
#if defined(FIPS_MODULE) && !defined(OPENSSL_NO_ACVP_TESTS)
|
|
info = rsa->acvp_test;
|
|
#endif
|
|
|
|
/* (Steps 1a-1b) : Currently ignores the strength check */
|
|
if (!ossl_rsa_sp800_56b_validate_strength(nbits, -1))
|
|
return 0;
|
|
|
|
/* Check that the RNG is capable of generating a key this large */
|
|
if (!rsa_validate_rng_strength(RAND_get0_private(rsa->libctx), nbits))
|
|
return 0;
|
|
|
|
ctx = BN_CTX_new_ex(rsa->libctx);
|
|
if (ctx == NULL)
|
|
return 0;
|
|
|
|
/* Set default if e is not passed in */
|
|
if (efixed == NULL) {
|
|
e = BN_new();
|
|
if (e == NULL || !BN_set_word(e, 65537))
|
|
goto err;
|
|
} else {
|
|
e = (BIGNUM *)efixed;
|
|
}
|
|
/* (Step 1c) fixed exponent is checked later .*/
|
|
|
|
for (;;) {
|
|
/* (Step 2) Generate prime factors */
|
|
if (!ossl_rsa_fips186_4_gen_prob_primes(rsa, info, nbits, e, ctx, cb))
|
|
goto err;
|
|
|
|
/* p>q check and skipping in case of acvp test */
|
|
if (info == NULL && BN_cmp(rsa->p, rsa->q) < 0) {
|
|
tmp = rsa->p;
|
|
rsa->p = rsa->q;
|
|
rsa->q = tmp;
|
|
}
|
|
|
|
/* (Steps 3-5) Compute params d, n, dP, dQ, qInv */
|
|
ok = ossl_rsa_sp800_56b_derive_params_from_pq(rsa, nbits, e, ctx);
|
|
if (ok < 0)
|
|
goto err;
|
|
if (ok > 0)
|
|
break;
|
|
/* Gets here if computed d is too small - so try again */
|
|
}
|
|
|
|
/* (Step 6) Do pairwise test - optional validity test has been omitted */
|
|
ret = ossl_rsa_sp800_56b_pairwise_test(rsa, ctx);
|
|
err:
|
|
if (efixed == NULL)
|
|
BN_free(e);
|
|
BN_CTX_free(ctx);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* See SP800-56Br1 6.3.1.3 (Step 6) Perform a pair-wise consistency test by
|
|
* verifying that: k = (k^e)^d mod n for some integer k where 1 < k < n-1.
|
|
*
|
|
* Returns 1 if the RSA key passes the pairwise test or 0 if it fails.
|
|
*/
|
|
int ossl_rsa_sp800_56b_pairwise_test(RSA *rsa, BN_CTX *ctx)
|
|
{
|
|
int ret = 0;
|
|
BIGNUM *k, *tmp;
|
|
|
|
BN_CTX_start(ctx);
|
|
tmp = BN_CTX_get(ctx);
|
|
k = BN_CTX_get(ctx);
|
|
if (k == NULL)
|
|
goto err;
|
|
BN_set_flags(k, BN_FLG_CONSTTIME);
|
|
|
|
ret = (BN_set_word(k, 2)
|
|
&& BN_mod_exp(tmp, k, rsa->e, rsa->n, ctx)
|
|
&& BN_mod_exp(tmp, tmp, rsa->d, rsa->n, ctx)
|
|
&& BN_cmp(k, tmp) == 0);
|
|
if (ret == 0)
|
|
ERR_raise(ERR_LIB_RSA, RSA_R_PAIRWISE_TEST_FAILURE);
|
|
err:
|
|
BN_CTX_end(ctx);
|
|
return ret;
|
|
}
|