xref: /openssh-portable/ssh-rsa.c (revision 48f54b9d)
1 /* $OpenBSD: ssh-rsa.c,v 1.67 2018/07/03 11:39:54 djm Exp $ */
2 /*
3  * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "includes.h"
19 
20 #ifdef WITH_OPENSSL
21 
22 #include <sys/types.h>
23 
24 #include <openssl/evp.h>
25 #include <openssl/err.h>
26 
27 #include <stdarg.h>
28 #include <string.h>
29 
30 #include "sshbuf.h"
31 #include "compat.h"
32 #include "ssherr.h"
33 #define SSHKEY_INTERNAL
34 #include "sshkey.h"
35 #include "digest.h"
36 #include "log.h"
37 
38 #include "openbsd-compat/openssl-compat.h"
39 
40 static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *);
41 
42 static const char *
rsa_hash_alg_ident(int hash_alg)43 rsa_hash_alg_ident(int hash_alg)
44 {
45 	switch (hash_alg) {
46 	case SSH_DIGEST_SHA1:
47 		return "ssh-rsa";
48 	case SSH_DIGEST_SHA256:
49 		return "rsa-sha2-256";
50 	case SSH_DIGEST_SHA512:
51 		return "rsa-sha2-512";
52 	}
53 	return NULL;
54 }
55 
56 /*
57  * Returns the hash algorithm ID for a given algorithm identifier as used
58  * inside the signature blob,
59  */
60 static int
rsa_hash_id_from_ident(const char * ident)61 rsa_hash_id_from_ident(const char *ident)
62 {
63 	if (strcmp(ident, "ssh-rsa") == 0)
64 		return SSH_DIGEST_SHA1;
65 	if (strcmp(ident, "rsa-sha2-256") == 0)
66 		return SSH_DIGEST_SHA256;
67 	if (strcmp(ident, "rsa-sha2-512") == 0)
68 		return SSH_DIGEST_SHA512;
69 	return -1;
70 }
71 
72 /*
73  * Return the hash algorithm ID for the specified key name. This includes
74  * all the cases of rsa_hash_id_from_ident() but also the certificate key
75  * types.
76  */
77 static int
rsa_hash_id_from_keyname(const char * alg)78 rsa_hash_id_from_keyname(const char *alg)
79 {
80 	int r;
81 
82 	if ((r = rsa_hash_id_from_ident(alg)) != -1)
83 		return r;
84 	if (strcmp(alg, "ssh-rsa-cert-v01@openssh.com") == 0)
85 		return SSH_DIGEST_SHA1;
86 	if (strcmp(alg, "rsa-sha2-256-cert-v01@openssh.com") == 0)
87 		return SSH_DIGEST_SHA256;
88 	if (strcmp(alg, "rsa-sha2-512-cert-v01@openssh.com") == 0)
89 		return SSH_DIGEST_SHA512;
90 	return -1;
91 }
92 
93 static int
rsa_hash_alg_nid(int type)94 rsa_hash_alg_nid(int type)
95 {
96 	switch (type) {
97 	case SSH_DIGEST_SHA1:
98 		return NID_sha1;
99 	case SSH_DIGEST_SHA256:
100 		return NID_sha256;
101 	case SSH_DIGEST_SHA512:
102 		return NID_sha512;
103 	default:
104 		return -1;
105 	}
106 }
107 
108 int
ssh_rsa_complete_crt_parameters(struct sshkey * key,const BIGNUM * iqmp)109 ssh_rsa_complete_crt_parameters(struct sshkey *key, const BIGNUM *iqmp)
110 {
111 	const BIGNUM *rsa_p, *rsa_q, *rsa_d;
112 	BIGNUM *aux = NULL, *d_consttime = NULL;
113 	BIGNUM *rsa_dmq1 = NULL, *rsa_dmp1 = NULL, *rsa_iqmp = NULL;
114 	BN_CTX *ctx = NULL;
115 	int r;
116 
117 	if (key == NULL || key->rsa == NULL ||
118 	    sshkey_type_plain(key->type) != KEY_RSA)
119 		return SSH_ERR_INVALID_ARGUMENT;
120 
121 	RSA_get0_key(key->rsa, NULL, NULL, &rsa_d);
122 	RSA_get0_factors(key->rsa, &rsa_p, &rsa_q);
123 
124 	if ((ctx = BN_CTX_new()) == NULL)
125 		return SSH_ERR_ALLOC_FAIL;
126 	if ((aux = BN_new()) == NULL ||
127 	    (rsa_dmq1 = BN_new()) == NULL ||
128 	    (rsa_dmp1 = BN_new()) == NULL)
129 		return SSH_ERR_ALLOC_FAIL;
130 	if ((d_consttime = BN_dup(rsa_d)) == NULL ||
131 	    (rsa_iqmp = BN_dup(iqmp)) == NULL) {
132 		r = SSH_ERR_ALLOC_FAIL;
133 		goto out;
134 	}
135 	BN_set_flags(aux, BN_FLG_CONSTTIME);
136 	BN_set_flags(d_consttime, BN_FLG_CONSTTIME);
137 
138 	if ((BN_sub(aux, rsa_q, BN_value_one()) == 0) ||
139 	    (BN_mod(rsa_dmq1, d_consttime, aux, ctx) == 0) ||
140 	    (BN_sub(aux, rsa_p, BN_value_one()) == 0) ||
141 	    (BN_mod(rsa_dmp1, d_consttime, aux, ctx) == 0)) {
142 		r = SSH_ERR_LIBCRYPTO_ERROR;
143 		goto out;
144 	}
145 	if (!RSA_set0_crt_params(key->rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp)) {
146 		r = SSH_ERR_LIBCRYPTO_ERROR;
147 		goto out;
148 	}
149 	rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL; /* transferred */
150 	/* success */
151 	r = 0;
152  out:
153 	BN_clear_free(aux);
154 	BN_clear_free(d_consttime);
155 	BN_clear_free(rsa_dmp1);
156 	BN_clear_free(rsa_dmq1);
157 	BN_clear_free(rsa_iqmp);
158 	BN_CTX_free(ctx);
159 	return r;
160 }
161 
162 /* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
163 int
ssh_rsa_sign(const struct sshkey * key,u_char ** sigp,size_t * lenp,const u_char * data,size_t datalen,const char * alg_ident)164 ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
165     const u_char *data, size_t datalen, const char *alg_ident)
166 {
167 	const BIGNUM *rsa_n;
168 	u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL;
169 	size_t slen = 0;
170 	u_int dlen, len;
171 	int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR;
172 	struct sshbuf *b = NULL;
173 
174 	if (lenp != NULL)
175 		*lenp = 0;
176 	if (sigp != NULL)
177 		*sigp = NULL;
178 
179 	if (alg_ident == NULL || strlen(alg_ident) == 0)
180 		hash_alg = SSH_DIGEST_SHA1;
181 	else
182 		hash_alg = rsa_hash_id_from_keyname(alg_ident);
183 	if (key == NULL || key->rsa == NULL || hash_alg == -1 ||
184 	    sshkey_type_plain(key->type) != KEY_RSA)
185 		return SSH_ERR_INVALID_ARGUMENT;
186 	RSA_get0_key(key->rsa, &rsa_n, NULL, NULL);
187 	if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
188 		return SSH_ERR_KEY_LENGTH;
189 	slen = RSA_size(key->rsa);
190 	if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM)
191 		return SSH_ERR_INVALID_ARGUMENT;
192 
193 	/* hash the data */
194 	nid = rsa_hash_alg_nid(hash_alg);
195 	if ((dlen = ssh_digest_bytes(hash_alg)) == 0)
196 		return SSH_ERR_INTERNAL_ERROR;
197 	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
198 	    digest, sizeof(digest))) != 0)
199 		goto out;
200 
201 	if ((sig = malloc(slen)) == NULL) {
202 		ret = SSH_ERR_ALLOC_FAIL;
203 		goto out;
204 	}
205 
206 	if (RSA_sign(nid, digest, dlen, sig, &len, key->rsa) != 1) {
207 		ret = SSH_ERR_LIBCRYPTO_ERROR;
208 		goto out;
209 	}
210 	if (len < slen) {
211 		size_t diff = slen - len;
212 		memmove(sig + diff, sig, len);
213 		explicit_bzero(sig, diff);
214 	} else if (len > slen) {
215 		ret = SSH_ERR_INTERNAL_ERROR;
216 		goto out;
217 	}
218 	/* encode signature */
219 	if ((b = sshbuf_new()) == NULL) {
220 		ret = SSH_ERR_ALLOC_FAIL;
221 		goto out;
222 	}
223 	if ((ret = sshbuf_put_cstring(b, rsa_hash_alg_ident(hash_alg))) != 0 ||
224 	    (ret = sshbuf_put_string(b, sig, slen)) != 0)
225 		goto out;
226 	len = sshbuf_len(b);
227 	if (sigp != NULL) {
228 		if ((*sigp = malloc(len)) == NULL) {
229 			ret = SSH_ERR_ALLOC_FAIL;
230 			goto out;
231 		}
232 		memcpy(*sigp, sshbuf_ptr(b), len);
233 	}
234 	if (lenp != NULL)
235 		*lenp = len;
236 	ret = 0;
237  out:
238 	explicit_bzero(digest, sizeof(digest));
239 	freezero(sig, slen);
240 	sshbuf_free(b);
241 	return ret;
242 }
243 
244 int
ssh_rsa_verify(const struct sshkey * key,const u_char * sig,size_t siglen,const u_char * data,size_t datalen,const char * alg)245 ssh_rsa_verify(const struct sshkey *key,
246     const u_char *sig, size_t siglen, const u_char *data, size_t datalen,
247     const char *alg)
248 {
249 	const BIGNUM *rsa_n;
250 	char *sigtype = NULL;
251 	int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
252 	size_t len = 0, diff, modlen, dlen;
253 	struct sshbuf *b = NULL;
254 	u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL;
255 
256 	if (key == NULL || key->rsa == NULL ||
257 	    sshkey_type_plain(key->type) != KEY_RSA ||
258 	    sig == NULL || siglen == 0)
259 		return SSH_ERR_INVALID_ARGUMENT;
260 	RSA_get0_key(key->rsa, &rsa_n, NULL, NULL);
261 	if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
262 		return SSH_ERR_KEY_LENGTH;
263 
264 	if ((b = sshbuf_from(sig, siglen)) == NULL)
265 		return SSH_ERR_ALLOC_FAIL;
266 	if (sshbuf_get_cstring(b, &sigtype, NULL) != 0) {
267 		ret = SSH_ERR_INVALID_FORMAT;
268 		goto out;
269 	}
270 	if ((hash_alg = rsa_hash_id_from_ident(sigtype)) == -1) {
271 		ret = SSH_ERR_KEY_TYPE_MISMATCH;
272 		goto out;
273 	}
274 	/*
275 	 * Allow ssh-rsa-cert-v01 certs to generate SHA2 signatures for
276 	 * legacy reasons, but otherwise the signature type should match.
277 	 */
278 	if (alg != NULL && strcmp(alg, "ssh-rsa-cert-v01@openssh.com") != 0) {
279 		if ((want_alg = rsa_hash_id_from_keyname(alg)) == -1) {
280 			ret = SSH_ERR_INVALID_ARGUMENT;
281 			goto out;
282 		}
283 		if (hash_alg != want_alg) {
284 			ret = SSH_ERR_SIGNATURE_INVALID;
285 			goto out;
286 		}
287 	}
288 	if (sshbuf_get_string(b, &sigblob, &len) != 0) {
289 		ret = SSH_ERR_INVALID_FORMAT;
290 		goto out;
291 	}
292 	if (sshbuf_len(b) != 0) {
293 		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
294 		goto out;
295 	}
296 	/* RSA_verify expects a signature of RSA_size */
297 	modlen = RSA_size(key->rsa);
298 	if (len > modlen) {
299 		ret = SSH_ERR_KEY_BITS_MISMATCH;
300 		goto out;
301 	} else if (len < modlen) {
302 		diff = modlen - len;
303 		osigblob = sigblob;
304 		if ((sigblob = realloc(sigblob, modlen)) == NULL) {
305 			sigblob = osigblob; /* put it back for clear/free */
306 			ret = SSH_ERR_ALLOC_FAIL;
307 			goto out;
308 		}
309 		memmove(sigblob + diff, sigblob, len);
310 		explicit_bzero(sigblob, diff);
311 		len = modlen;
312 	}
313 	if ((dlen = ssh_digest_bytes(hash_alg)) == 0) {
314 		ret = SSH_ERR_INTERNAL_ERROR;
315 		goto out;
316 	}
317 	if ((ret = ssh_digest_memory(hash_alg, data, datalen,
318 	    digest, sizeof(digest))) != 0)
319 		goto out;
320 
321 	ret = openssh_RSA_verify(hash_alg, digest, dlen, sigblob, len,
322 	    key->rsa);
323  out:
324 	freezero(sigblob, len);
325 	free(sigtype);
326 	sshbuf_free(b);
327 	explicit_bzero(digest, sizeof(digest));
328 	return ret;
329 }
330 
331 /*
332  * See:
333  * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/
334  * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn
335  */
336 
337 /*
338  * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
339  *	oiw(14) secsig(3) algorithms(2) 26 }
340  */
341 static const u_char id_sha1[] = {
342 	0x30, 0x21, /* type Sequence, length 0x21 (33) */
343 	0x30, 0x09, /* type Sequence, length 0x09 */
344 	0x06, 0x05, /* type OID, length 0x05 */
345 	0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */
346 	0x05, 0x00, /* NULL */
347 	0x04, 0x14  /* Octet string, length 0x14 (20), followed by sha1 hash */
348 };
349 
350 /*
351  * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
352  * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
353  *      organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
354  *      id-sha256(1) }
355  */
356 static const u_char id_sha256[] = {
357 	0x30, 0x31, /* type Sequence, length 0x31 (49) */
358 	0x30, 0x0d, /* type Sequence, length 0x0d (13) */
359 	0x06, 0x09, /* type OID, length 0x09 */
360 	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */
361 	0x05, 0x00, /* NULL */
362 	0x04, 0x20  /* Octet string, length 0x20 (32), followed by sha256 hash */
363 };
364 
365 /*
366  * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html
367  * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
368  *      organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2)
369  *      id-sha256(3) }
370  */
371 static const u_char id_sha512[] = {
372 	0x30, 0x51, /* type Sequence, length 0x51 (81) */
373 	0x30, 0x0d, /* type Sequence, length 0x0d (13) */
374 	0x06, 0x09, /* type OID, length 0x09 */
375 	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */
376 	0x05, 0x00, /* NULL */
377 	0x04, 0x40  /* Octet string, length 0x40 (64), followed by sha512 hash */
378 };
379 
380 static int
rsa_hash_alg_oid(int hash_alg,const u_char ** oidp,size_t * oidlenp)381 rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp)
382 {
383 	switch (hash_alg) {
384 	case SSH_DIGEST_SHA1:
385 		*oidp = id_sha1;
386 		*oidlenp = sizeof(id_sha1);
387 		break;
388 	case SSH_DIGEST_SHA256:
389 		*oidp = id_sha256;
390 		*oidlenp = sizeof(id_sha256);
391 		break;
392 	case SSH_DIGEST_SHA512:
393 		*oidp = id_sha512;
394 		*oidlenp = sizeof(id_sha512);
395 		break;
396 	default:
397 		return SSH_ERR_INVALID_ARGUMENT;
398 	}
399 	return 0;
400 }
401 
402 static int
openssh_RSA_verify(int hash_alg,u_char * hash,size_t hashlen,u_char * sigbuf,size_t siglen,RSA * rsa)403 openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen,
404     u_char *sigbuf, size_t siglen, RSA *rsa)
405 {
406 	size_t rsasize = 0, oidlen = 0, hlen = 0;
407 	int ret, len, oidmatch, hashmatch;
408 	const u_char *oid = NULL;
409 	u_char *decrypted = NULL;
410 
411 	if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0)
412 		return ret;
413 	ret = SSH_ERR_INTERNAL_ERROR;
414 	hlen = ssh_digest_bytes(hash_alg);
415 	if (hashlen != hlen) {
416 		ret = SSH_ERR_INVALID_ARGUMENT;
417 		goto done;
418 	}
419 	rsasize = RSA_size(rsa);
420 	if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM ||
421 	    siglen == 0 || siglen > rsasize) {
422 		ret = SSH_ERR_INVALID_ARGUMENT;
423 		goto done;
424 	}
425 	if ((decrypted = malloc(rsasize)) == NULL) {
426 		ret = SSH_ERR_ALLOC_FAIL;
427 		goto done;
428 	}
429 	if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa,
430 	    RSA_PKCS1_PADDING)) < 0) {
431 		ret = SSH_ERR_LIBCRYPTO_ERROR;
432 		goto done;
433 	}
434 	if (len < 0 || (size_t)len != hlen + oidlen) {
435 		ret = SSH_ERR_INVALID_FORMAT;
436 		goto done;
437 	}
438 	oidmatch = timingsafe_bcmp(decrypted, oid, oidlen) == 0;
439 	hashmatch = timingsafe_bcmp(decrypted + oidlen, hash, hlen) == 0;
440 	if (!oidmatch || !hashmatch) {
441 		ret = SSH_ERR_SIGNATURE_INVALID;
442 		goto done;
443 	}
444 	ret = 0;
445 done:
446 	freezero(decrypted, rsasize);
447 	return ret;
448 }
449 #endif /* WITH_OPENSSL */
450