From: lizhi <lizhi206@huawei.com> Several utility functions are introduced to the RSA implementation. These functions are designed to adapt the existing RSA implementation to support multiple padding modes, enhancing the Extensibility of the cryptographic operations. Signed-off-by: lizhi <lizhi206@huawei.com> --- src/Makefile.am | 1 + src/uadk_prov_rsa_utils.c | 138 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 139 insertions(+) create mode 100644 src/uadk_prov_rsa_utils.c diff --git a/src/Makefile.am b/src/Makefile.am index 7ce9aeb..22f1069 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -64,6 +64,7 @@ uadk_provider_la_SOURCES=uadk_prov_init.c uadk_async.c uadk_utils.c \ uadk_prov_digest.c uadk_prov_cipher.c \ uadk_prov_rsa.c uadk_prov_rsa_kmgmt.c \ uadk_prov_rsa_enc.c uadk_prov_rsa_sign.c \ + uadk_prov_rsa_utils.c \ uadk_prov_dh.c uadk_prov_bio.c \ uadk_prov_der_writer.c uadk_prov_packet.c \ uadk_prov_pkey.c uadk_prov_sm2.c \ diff --git a/src/uadk_prov_rsa_utils.c b/src/uadk_prov_rsa_utils.c new file mode 100644 index 0000000..240851a --- /dev/null +++ b/src/uadk_prov_rsa_utils.c @@ -0,0 +1,138 @@ +// SPDX-License-Identifier: Apache-2.0 +/* + * Copyright 2023-2024 Huawei Technologies Co.,Ltd. All rights reserved. + * Copyright 2023-2024 Linaro ltd. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#include "uadk_prov_rsa.h" + +/* True if PSS parameters are restricted */ +#define rsa_pss_restricted(prsactx) (prsactx->min_saltlen != -1) + +static struct rsa_pss_params_30_st *ossl_rsa_get0_pss_params_30(RSA *r) +{ + return &r->pss_params; +} + +static struct rsa_pss_params_30_st default_RSASSA_PSS_params = { + NID_sha1, /* default hashAlgorithm */ + { + NID_mgf1, /* default maskGenAlgorithm */ + NID_sha1 /* default MGF1 hash */ + }, + 20, /* default saltLength */ + 1 /* default trailerField (0xBC) */ +}; + +static int ossl_rsa_pss_params_30_is_unrestricted(const struct rsa_pss_params_30_st *rsa_pss_params) +{ + static struct rsa_pss_params_30_st pss_params_cmp = { 0, }; + + return !rsa_pss_params || + memcmp(rsa_pss_params, &pss_params_cmp, + sizeof(*rsa_pss_params)) == 0; +} + +static int ossl_rsa_pss_params_30_maskgenhashalg(const struct rsa_pss_params_30_st *rsa_pss_params) +{ + if (!rsa_pss_params) + return default_RSASSA_PSS_params.hash_algorithm_nid; + return rsa_pss_params->mask_gen.hash_algorithm_nid; +} + +static int ossl_rsa_pss_params_30_saltlen(const struct rsa_pss_params_30_st *rsa_pss_params) +{ + if (!rsa_pss_params) + return default_RSASSA_PSS_params.salt_len; + return rsa_pss_params->salt_len; +} + +static int ossl_rsa_pss_params_30_hashalg(const struct rsa_pss_params_30_st *rsa_pss_params) +{ + if (!rsa_pss_params) + return default_RSASSA_PSS_params.hash_algorithm_nid; + return rsa_pss_params->hash_algorithm_nid; +} + +static const char *nid2name(int meth, const OSSL_ITEM *items, size_t items_n) +{ + size_t i; + + for (i = 0; i < items_n; i++) + if (meth == (int)items[i].id) + return items[i].ptr; + return NULL; +} + +static const OSSL_ITEM oaeppss_name_nid_map[] = { + { NID_sha1, OSSL_DIGEST_NAME_SHA1 }, + { NID_sha224, OSSL_DIGEST_NAME_SHA2_224 }, + { NID_sha256, OSSL_DIGEST_NAME_SHA2_256 }, + { NID_sha384, OSSL_DIGEST_NAME_SHA2_384 }, + { NID_sha512, OSSL_DIGEST_NAME_SHA2_512 }, + { NID_sha512_224, OSSL_DIGEST_NAME_SHA2_512_224 }, + { NID_sha512_256, OSSL_DIGEST_NAME_SHA2_512_256 }, +}; + +static const char *ossl_rsa_oaeppss_nid2name(int md) +{ + return nid2name(md, oaeppss_name_nid_map, OSSL_NELEM(oaeppss_name_nid_map)); +} + +/* + * Internal library code deals with NIDs, so we need to translate from a name. + * We do so using EVP_MD_is_a(), and therefore need a name to NID map. + */ +static int ossl_digest_md_to_nid(const EVP_MD *md, const OSSL_ITEM *it, size_t it_len) +{ + size_t i; + + if (!md) + return NID_undef; + + for (i = 0; i < it_len; i++) + if (EVP_MD_is_a(md, it[i].ptr)) + return (int)it[i].id; + return NID_undef; +} + +/* + * Retrieve one of the FIPS approved hash algorithms by nid. + * See FIPS 180-4 "Secure Hash Standard" and FIPS 202 - SHA-3. + */ +static int ossl_digest_get_approved_nid(const EVP_MD *md) +{ + static const OSSL_ITEM name_to_nid[] = { + { NID_sha1, OSSL_DIGEST_NAME_SHA1 }, + { NID_sha224, OSSL_DIGEST_NAME_SHA2_224 }, + { NID_sha256, OSSL_DIGEST_NAME_SHA2_256 }, + { NID_sha384, OSSL_DIGEST_NAME_SHA2_384 }, + { NID_sha512, OSSL_DIGEST_NAME_SHA2_512 }, + { NID_sha512_224, OSSL_DIGEST_NAME_SHA2_512_224 }, + { NID_sha512_256, OSSL_DIGEST_NAME_SHA2_512_256 }, + { NID_sha3_224, OSSL_DIGEST_NAME_SHA3_224 }, + { NID_sha3_256, OSSL_DIGEST_NAME_SHA3_256 }, + { NID_sha3_384, OSSL_DIGEST_NAME_SHA3_384 }, + { NID_sha3_512, OSSL_DIGEST_NAME_SHA3_512 }, + }; + + return ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid)); +} + +static int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md, + int sha1_allowed) +{ + return ossl_digest_get_approved_nid(md); +} -- 2.43.0