ssh-rsa.c revision 204917
1/* $OpenBSD: ssh-rsa.c,v 1.40 2010/02/26 20:29:54 djm Exp $ */ 2/* 3 * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18#include "includes.h" 19 20#include <sys/types.h> 21 22#include <openssl/evp.h> 23#include <openssl/err.h> 24 25#include <stdarg.h> 26#include <string.h> 27 28#include "xmalloc.h" 29#include "log.h" 30#include "buffer.h" 31#include "key.h" 32#include "compat.h" 33#include "ssh.h" 34 35static int openssh_RSA_verify(int, u_char *, u_int, u_char *, u_int, RSA *); 36 37/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */ 38int 39ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp, 40 const u_char *data, u_int datalen) 41{ 42 const EVP_MD *evp_md; 43 EVP_MD_CTX md; 44 u_char digest[EVP_MAX_MD_SIZE], *sig; 45 u_int slen, dlen, len; 46 int ok, nid; 47 Buffer b; 48 49 if (key == NULL || 50 (key->type != KEY_RSA && key->type != KEY_RSA_CERT) || 51 key->rsa == NULL) { 52 error("ssh_rsa_sign: no RSA key"); 53 return -1; 54 } 55 nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1; 56 if ((evp_md = EVP_get_digestbynid(nid)) == NULL) { 57 error("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid); 58 return -1; 59 } 60 EVP_DigestInit(&md, evp_md); 61 EVP_DigestUpdate(&md, data, datalen); 62 EVP_DigestFinal(&md, digest, &dlen); 63 64 slen = RSA_size(key->rsa); 65 sig = xmalloc(slen); 66 67 ok = RSA_sign(nid, digest, dlen, sig, &len, key->rsa); 68 memset(digest, 'd', sizeof(digest)); 69 70 if (ok != 1) { 71 int ecode = ERR_get_error(); 72 73 error("ssh_rsa_sign: RSA_sign failed: %s", 74 ERR_error_string(ecode, NULL)); 75 xfree(sig); 76 return -1; 77 } 78 if (len < slen) { 79 u_int diff = slen - len; 80 debug("slen %u > len %u", slen, len); 81 memmove(sig + diff, sig, len); 82 memset(sig, 0, diff); 83 } else if (len > slen) { 84 error("ssh_rsa_sign: slen %u slen2 %u", slen, len); 85 xfree(sig); 86 return -1; 87 } 88 /* encode signature */ 89 buffer_init(&b); 90 buffer_put_cstring(&b, "ssh-rsa"); 91 buffer_put_string(&b, sig, slen); 92 len = buffer_len(&b); 93 if (lenp != NULL) 94 *lenp = len; 95 if (sigp != NULL) { 96 *sigp = xmalloc(len); 97 memcpy(*sigp, buffer_ptr(&b), len); 98 } 99 buffer_free(&b); 100 memset(sig, 's', slen); 101 xfree(sig); 102 103 return 0; 104} 105 106int 107ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen, 108 const u_char *data, u_int datalen) 109{ 110 Buffer b; 111 const EVP_MD *evp_md; 112 EVP_MD_CTX md; 113 char *ktype; 114 u_char digest[EVP_MAX_MD_SIZE], *sigblob; 115 u_int len, dlen, modlen; 116 int rlen, ret, nid; 117 118 if (key == NULL || 119 (key->type != KEY_RSA && key->type != KEY_RSA_CERT) || 120 key->rsa == NULL) { 121 error("ssh_rsa_verify: no RSA key"); 122 return -1; 123 } 124 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 125 error("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits", 126 BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 127 return -1; 128 } 129 buffer_init(&b); 130 buffer_append(&b, signature, signaturelen); 131 ktype = buffer_get_string(&b, NULL); 132 if (strcmp("ssh-rsa", ktype) != 0) { 133 error("ssh_rsa_verify: cannot handle type %s", ktype); 134 buffer_free(&b); 135 xfree(ktype); 136 return -1; 137 } 138 xfree(ktype); 139 sigblob = buffer_get_string(&b, &len); 140 rlen = buffer_len(&b); 141 buffer_free(&b); 142 if (rlen != 0) { 143 error("ssh_rsa_verify: remaining bytes in signature %d", rlen); 144 xfree(sigblob); 145 return -1; 146 } 147 /* RSA_verify expects a signature of RSA_size */ 148 modlen = RSA_size(key->rsa); 149 if (len > modlen) { 150 error("ssh_rsa_verify: len %u > modlen %u", len, modlen); 151 xfree(sigblob); 152 return -1; 153 } else if (len < modlen) { 154 u_int diff = modlen - len; 155 debug("ssh_rsa_verify: add padding: modlen %u > len %u", 156 modlen, len); 157 sigblob = xrealloc(sigblob, 1, modlen); 158 memmove(sigblob + diff, sigblob, len); 159 memset(sigblob, 0, diff); 160 len = modlen; 161 } 162 nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1; 163 if ((evp_md = EVP_get_digestbynid(nid)) == NULL) { 164 error("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid); 165 xfree(sigblob); 166 return -1; 167 } 168 EVP_DigestInit(&md, evp_md); 169 EVP_DigestUpdate(&md, data, datalen); 170 EVP_DigestFinal(&md, digest, &dlen); 171 172 ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa); 173 memset(digest, 'd', sizeof(digest)); 174 memset(sigblob, 's', len); 175 xfree(sigblob); 176 debug("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : ""); 177 return ret; 178} 179 180/* 181 * See: 182 * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/ 183 * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn 184 */ 185/* 186 * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) 187 * oiw(14) secsig(3) algorithms(2) 26 } 188 */ 189static const u_char id_sha1[] = { 190 0x30, 0x21, /* type Sequence, length 0x21 (33) */ 191 0x30, 0x09, /* type Sequence, length 0x09 */ 192 0x06, 0x05, /* type OID, length 0x05 */ 193 0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */ 194 0x05, 0x00, /* NULL */ 195 0x04, 0x14 /* Octet string, length 0x14 (20), followed by sha1 hash */ 196}; 197/* 198 * id-md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 199 * rsadsi(113549) digestAlgorithm(2) 5 } 200 */ 201static const u_char id_md5[] = { 202 0x30, 0x20, /* type Sequence, length 0x20 (32) */ 203 0x30, 0x0c, /* type Sequence, length 0x09 */ 204 0x06, 0x08, /* type OID, length 0x05 */ 205 0x2a, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, /* id-md5 */ 206 0x05, 0x00, /* NULL */ 207 0x04, 0x10 /* Octet string, length 0x10 (16), followed by md5 hash */ 208}; 209 210static int 211openssh_RSA_verify(int type, u_char *hash, u_int hashlen, 212 u_char *sigbuf, u_int siglen, RSA *rsa) 213{ 214 u_int ret, rsasize, oidlen = 0, hlen = 0; 215 int len; 216 const u_char *oid = NULL; 217 u_char *decrypted = NULL; 218 219 ret = 0; 220 switch (type) { 221 case NID_sha1: 222 oid = id_sha1; 223 oidlen = sizeof(id_sha1); 224 hlen = 20; 225 break; 226 case NID_md5: 227 oid = id_md5; 228 oidlen = sizeof(id_md5); 229 hlen = 16; 230 break; 231 default: 232 goto done; 233 } 234 if (hashlen != hlen) { 235 error("bad hashlen"); 236 goto done; 237 } 238 rsasize = RSA_size(rsa); 239 if (siglen == 0 || siglen > rsasize) { 240 error("bad siglen"); 241 goto done; 242 } 243 decrypted = xmalloc(rsasize); 244 if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa, 245 RSA_PKCS1_PADDING)) < 0) { 246 error("RSA_public_decrypt failed: %s", 247 ERR_error_string(ERR_get_error(), NULL)); 248 goto done; 249 } 250 if (len < 0 || (u_int)len != hlen + oidlen) { 251 error("bad decrypted len: %d != %d + %d", len, hlen, oidlen); 252 goto done; 253 } 254 if (memcmp(decrypted, oid, oidlen) != 0) { 255 error("oid mismatch"); 256 goto done; 257 } 258 if (memcmp(decrypted + oidlen, hash, hlen) != 0) { 259 error("hash mismatch"); 260 goto done; 261 } 262 ret = 1; 263done: 264 if (decrypted) 265 xfree(decrypted); 266 return ret; 267} 268