1 /* $NetBSD: ssh-rsa.c,v 1.11 2016/12/25 00:07:47 christos Exp $ */ 2 /* $OpenBSD: ssh-rsa.c,v 1.60 2016/09/12 23:39:34 djm Exp $ */ 3 4 /* 5 * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 #include "includes.h" 21 __RCSID("$NetBSD: ssh-rsa.c,v 1.11 2016/12/25 00:07:47 christos Exp $"); 22 #include <sys/types.h> 23 24 #include <openssl/evp.h> 25 #include <openssl/err.h> 26 27 #include <string.h> 28 29 #include "sshbuf.h" 30 #include "compat.h" 31 #include "ssherr.h" 32 #define SSHKEY_INTERNAL 33 #include "sshkey.h" 34 #include "digest.h" 35 36 static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *); 37 38 static const char * 39 rsa_hash_alg_ident(int hash_alg) 40 { 41 switch (hash_alg) { 42 case SSH_DIGEST_SHA1: 43 return "ssh-rsa"; 44 case SSH_DIGEST_SHA256: 45 return "rsa-sha2-256"; 46 case SSH_DIGEST_SHA512: 47 return "rsa-sha2-512"; 48 } 49 return NULL; 50 } 51 52 static int 53 rsa_hash_alg_from_ident(const char *ident) 54 { 55 if (strcmp(ident, "ssh-rsa") == 0 || 56 strcmp(ident, "ssh-rsa-cert-v01@openssh.com") == 0) 57 return SSH_DIGEST_SHA1; 58 if (strcmp(ident, "rsa-sha2-256") == 0) 59 return SSH_DIGEST_SHA256; 60 if (strcmp(ident, "rsa-sha2-512") == 0) 61 return SSH_DIGEST_SHA512; 62 return -1; 63 } 64 65 static int 66 rsa_hash_alg_nid(int type) 67 { 68 switch (type) { 69 case SSH_DIGEST_SHA1: 70 return NID_sha1; 71 case SSH_DIGEST_SHA256: 72 return NID_sha256; 73 case SSH_DIGEST_SHA512: 74 return NID_sha512; 75 default: 76 return -1; 77 } 78 } 79 80 /* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */ 81 int 82 ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, 83 const u_char *data, size_t datalen, const char *alg_ident) 84 { 85 u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL; 86 size_t slen; 87 u_int dlen, len; 88 int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR; 89 struct sshbuf *b = NULL; 90 91 if (lenp != NULL) 92 *lenp = 0; 93 if (sigp != NULL) 94 *sigp = NULL; 95 96 if (alg_ident == NULL || strlen(alg_ident) == 0) 97 hash_alg = SSH_DIGEST_SHA1; 98 else 99 hash_alg = rsa_hash_alg_from_ident(alg_ident); 100 if (key == NULL || key->rsa == NULL || hash_alg == -1 || 101 sshkey_type_plain(key->type) != KEY_RSA || 102 BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) 103 return SSH_ERR_INVALID_ARGUMENT; 104 slen = RSA_size(key->rsa); 105 if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM) 106 return SSH_ERR_INVALID_ARGUMENT; 107 108 /* hash the data */ 109 nid = rsa_hash_alg_nid(hash_alg); 110 if ((dlen = ssh_digest_bytes(hash_alg)) == 0) 111 return SSH_ERR_INTERNAL_ERROR; 112 if ((ret = ssh_digest_memory(hash_alg, data, datalen, 113 digest, sizeof(digest))) != 0) 114 goto out; 115 116 if ((sig = malloc(slen)) == NULL) { 117 ret = SSH_ERR_ALLOC_FAIL; 118 goto out; 119 } 120 121 if (RSA_sign(nid, digest, dlen, sig, &len, key->rsa) != 1) { 122 ret = SSH_ERR_LIBCRYPTO_ERROR; 123 goto out; 124 } 125 if (len < slen) { 126 size_t diff = slen - len; 127 memmove(sig + diff, sig, len); 128 explicit_bzero(sig, diff); 129 } else if (len > slen) { 130 ret = SSH_ERR_INTERNAL_ERROR; 131 goto out; 132 } 133 /* encode signature */ 134 if ((b = sshbuf_new()) == NULL) { 135 ret = SSH_ERR_ALLOC_FAIL; 136 goto out; 137 } 138 if ((ret = sshbuf_put_cstring(b, rsa_hash_alg_ident(hash_alg))) != 0 || 139 (ret = sshbuf_put_string(b, sig, slen)) != 0) 140 goto out; 141 len = sshbuf_len(b); 142 if (sigp != NULL) { 143 if ((*sigp = malloc(len)) == NULL) { 144 ret = SSH_ERR_ALLOC_FAIL; 145 goto out; 146 } 147 memcpy(*sigp, sshbuf_ptr(b), len); 148 } 149 if (lenp != NULL) 150 *lenp = len; 151 ret = 0; 152 out: 153 explicit_bzero(digest, sizeof(digest)); 154 if (sig != NULL) { 155 explicit_bzero(sig, slen); 156 free(sig); 157 } 158 sshbuf_free(b); 159 return ret; 160 } 161 162 int 163 ssh_rsa_verify(const struct sshkey *key, 164 const u_char *sig, size_t siglen, const u_char *data, size_t datalen) 165 { 166 char *ktype = NULL; 167 int hash_alg, ret = SSH_ERR_INTERNAL_ERROR; 168 size_t len, diff, modlen, dlen; 169 struct sshbuf *b = NULL; 170 u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL; 171 172 if (key == NULL || key->rsa == NULL || 173 sshkey_type_plain(key->type) != KEY_RSA || 174 BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE || 175 sig == NULL || siglen == 0) 176 return SSH_ERR_INVALID_ARGUMENT; 177 178 if ((b = sshbuf_from(sig, siglen)) == NULL) 179 return SSH_ERR_ALLOC_FAIL; 180 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 181 ret = SSH_ERR_INVALID_FORMAT; 182 goto out; 183 } 184 if ((hash_alg = rsa_hash_alg_from_ident(ktype)) == -1) { 185 ret = SSH_ERR_KEY_TYPE_MISMATCH; 186 goto out; 187 } 188 if (sshbuf_get_string(b, &sigblob, &len) != 0) { 189 ret = SSH_ERR_INVALID_FORMAT; 190 goto out; 191 } 192 if (sshbuf_len(b) != 0) { 193 ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; 194 goto out; 195 } 196 /* RSA_verify expects a signature of RSA_size */ 197 modlen = RSA_size(key->rsa); 198 if (len > modlen) { 199 ret = SSH_ERR_KEY_BITS_MISMATCH; 200 goto out; 201 } else if (len < modlen) { 202 diff = modlen - len; 203 osigblob = sigblob; 204 if ((sigblob = realloc(sigblob, modlen)) == NULL) { 205 sigblob = osigblob; /* put it back for clear/free */ 206 ret = SSH_ERR_ALLOC_FAIL; 207 goto out; 208 } 209 memmove(sigblob + diff, sigblob, len); 210 explicit_bzero(sigblob, diff); 211 len = modlen; 212 } 213 if ((dlen = ssh_digest_bytes(hash_alg)) == 0) { 214 ret = SSH_ERR_INTERNAL_ERROR; 215 goto out; 216 } 217 if ((ret = ssh_digest_memory(hash_alg, data, datalen, 218 digest, sizeof(digest))) != 0) 219 goto out; 220 221 ret = openssh_RSA_verify(hash_alg, digest, dlen, sigblob, len, 222 key->rsa); 223 out: 224 if (sigblob != NULL) { 225 explicit_bzero(sigblob, len); 226 free(sigblob); 227 } 228 free(ktype); 229 sshbuf_free(b); 230 explicit_bzero(digest, sizeof(digest)); 231 return ret; 232 } 233 234 /* 235 * See: 236 * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/ 237 * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn 238 */ 239 240 /* 241 * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) 242 * oiw(14) secsig(3) algorithms(2) 26 } 243 */ 244 static const u_char id_sha1[] = { 245 0x30, 0x21, /* type Sequence, length 0x21 (33) */ 246 0x30, 0x09, /* type Sequence, length 0x09 */ 247 0x06, 0x05, /* type OID, length 0x05 */ 248 0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */ 249 0x05, 0x00, /* NULL */ 250 0x04, 0x14 /* Octet string, length 0x14 (20), followed by sha1 hash */ 251 }; 252 253 /* 254 * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html 255 * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) 256 * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2) 257 * id-sha256(1) } 258 */ 259 static const u_char id_sha256[] = { 260 0x30, 0x31, /* type Sequence, length 0x31 (49) */ 261 0x30, 0x0d, /* type Sequence, length 0x0d (13) */ 262 0x06, 0x09, /* type OID, length 0x09 */ 263 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */ 264 0x05, 0x00, /* NULL */ 265 0x04, 0x20 /* Octet string, length 0x20 (32), followed by sha256 hash */ 266 }; 267 268 /* 269 * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html 270 * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) 271 * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2) 272 * id-sha256(3) } 273 */ 274 static const u_char id_sha512[] = { 275 0x30, 0x51, /* type Sequence, length 0x51 (81) */ 276 0x30, 0x0d, /* type Sequence, length 0x0d (13) */ 277 0x06, 0x09, /* type OID, length 0x09 */ 278 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */ 279 0x05, 0x00, /* NULL */ 280 0x04, 0x40 /* Octet string, length 0x40 (64), followed by sha512 hash */ 281 }; 282 283 static int 284 rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp) 285 { 286 switch (hash_alg) { 287 case SSH_DIGEST_SHA1: 288 *oidp = id_sha1; 289 *oidlenp = sizeof(id_sha1); 290 break; 291 case SSH_DIGEST_SHA256: 292 *oidp = id_sha256; 293 *oidlenp = sizeof(id_sha256); 294 break; 295 case SSH_DIGEST_SHA512: 296 *oidp = id_sha512; 297 *oidlenp = sizeof(id_sha512); 298 break; 299 default: 300 return SSH_ERR_INVALID_ARGUMENT; 301 } 302 return 0; 303 } 304 305 static int 306 openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen, 307 u_char *sigbuf, size_t siglen, RSA *rsa) 308 { 309 size_t rsasize = 0, oidlen = 0, hlen = 0; 310 int ret, len, oidmatch, hashmatch; 311 const u_char *oid = NULL; 312 u_char *decrypted = NULL; 313 314 if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0) 315 return ret; 316 ret = SSH_ERR_INTERNAL_ERROR; 317 hlen = ssh_digest_bytes(hash_alg); 318 if (hashlen != hlen) { 319 ret = SSH_ERR_INVALID_ARGUMENT; 320 goto done; 321 } 322 rsasize = RSA_size(rsa); 323 if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM || 324 siglen == 0 || siglen > rsasize) { 325 ret = SSH_ERR_INVALID_ARGUMENT; 326 goto done; 327 } 328 if ((decrypted = malloc(rsasize)) == NULL) { 329 ret = SSH_ERR_ALLOC_FAIL; 330 goto done; 331 } 332 if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa, 333 RSA_PKCS1_PADDING)) < 0) { 334 ret = SSH_ERR_LIBCRYPTO_ERROR; 335 goto done; 336 } 337 if (len < 0 || (size_t)len != hlen + oidlen) { 338 ret = SSH_ERR_INVALID_FORMAT; 339 goto done; 340 } 341 oidmatch = timingsafe_bcmp(decrypted, oid, oidlen) == 0; 342 hashmatch = timingsafe_bcmp(decrypted + oidlen, hash, hlen) == 0; 343 if (!oidmatch || !hashmatch) { 344 ret = SSH_ERR_SIGNATURE_INVALID; 345 goto done; 346 } 347 ret = 0; 348 done: 349 if (decrypted) { 350 explicit_bzero(decrypted, rsasize); 351 free(decrypted); 352 } 353 return ret; 354 } 355