avb_rsa.c 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276
  1. // SPDX-License-Identifier: MIT OR BSD-3-Clause
  2. /*
  3. * Copyright (C) 2016 The Android Open Source Project
  4. */
  5. /* Implementation of RSA signature verification which uses a pre-processed
  6. * key for computation. The code extends libmincrypt RSA verification code to
  7. * support multiple RSA key lengths and hash digest algorithms.
  8. */
  9. #include "avb_rsa.h"
  10. #include "avb_sha.h"
  11. #include "avb_util.h"
  12. #include "avb_vbmeta_image.h"
  13. #include <malloc.h>
  14. typedef struct IAvbKey {
  15. unsigned int len; /* Length of n[] in number of uint32_t */
  16. uint32_t n0inv; /* -1 / n[0] mod 2^32 */
  17. uint32_t* n; /* modulus as array (host-byte order) */
  18. uint32_t* rr; /* R^2 as array (host-byte order) */
  19. } IAvbKey;
  20. static IAvbKey* iavb_parse_key_data(const uint8_t* data, size_t length) {
  21. AvbRSAPublicKeyHeader h;
  22. IAvbKey* key = NULL;
  23. size_t expected_length;
  24. unsigned int i;
  25. const uint8_t* n;
  26. const uint8_t* rr;
  27. if (!avb_rsa_public_key_header_validate_and_byteswap(
  28. (const AvbRSAPublicKeyHeader*)data, &h)) {
  29. avb_error("Invalid key.\n");
  30. goto fail;
  31. }
  32. if (!(h.key_num_bits == 2048 || h.key_num_bits == 4096 ||
  33. h.key_num_bits == 8192)) {
  34. avb_error("Unexpected key length.\n");
  35. goto fail;
  36. }
  37. expected_length = sizeof(AvbRSAPublicKeyHeader) + 2 * h.key_num_bits / 8;
  38. if (length != expected_length) {
  39. avb_error("Key does not match expected length.\n");
  40. goto fail;
  41. }
  42. n = data + sizeof(AvbRSAPublicKeyHeader);
  43. rr = data + sizeof(AvbRSAPublicKeyHeader) + h.key_num_bits / 8;
  44. /* Store n and rr following the key header so we only have to do one
  45. * allocation.
  46. */
  47. key = (IAvbKey*)(avb_malloc(sizeof(IAvbKey) + 2 * h.key_num_bits / 8));
  48. if (key == NULL) {
  49. goto fail;
  50. }
  51. key->len = h.key_num_bits / 32;
  52. key->n0inv = h.n0inv;
  53. key->n = (uint32_t*)(key + 1); /* Skip ahead sizeof(IAvbKey) bytes. */
  54. key->rr = key->n + key->len;
  55. /* Crypto-code below (modpowF4() and friends) expects the key in
  56. * little-endian format (rather than the format we're storing the
  57. * key in), so convert it.
  58. */
  59. for (i = 0; i < key->len; i++) {
  60. key->n[i] = avb_be32toh(((uint32_t*)n)[key->len - i - 1]);
  61. key->rr[i] = avb_be32toh(((uint32_t*)rr)[key->len - i - 1]);
  62. }
  63. return key;
  64. fail:
  65. if (key != NULL) {
  66. avb_free(key);
  67. }
  68. return NULL;
  69. }
  70. static void iavb_free_parsed_key(IAvbKey* key) {
  71. avb_free(key);
  72. }
  73. /* a[] -= mod */
  74. static void subM(const IAvbKey* key, uint32_t* a) {
  75. int64_t A = 0;
  76. uint32_t i;
  77. for (i = 0; i < key->len; ++i) {
  78. A += (uint64_t)a[i] - key->n[i];
  79. a[i] = (uint32_t)A;
  80. A >>= 32;
  81. }
  82. }
  83. /* return a[] >= mod */
  84. static int geM(const IAvbKey* key, uint32_t* a) {
  85. uint32_t i;
  86. for (i = key->len; i;) {
  87. --i;
  88. if (a[i] < key->n[i]) {
  89. return 0;
  90. }
  91. if (a[i] > key->n[i]) {
  92. return 1;
  93. }
  94. }
  95. return 1; /* equal */
  96. }
  97. /* montgomery c[] += a * b[] / R % mod */
  98. static void montMulAdd(const IAvbKey* key,
  99. uint32_t* c,
  100. const uint32_t a,
  101. const uint32_t* b) {
  102. uint64_t A = (uint64_t)a * b[0] + c[0];
  103. uint32_t d0 = (uint32_t)A * key->n0inv;
  104. uint64_t B = (uint64_t)d0 * key->n[0] + (uint32_t)A;
  105. uint32_t i;
  106. for (i = 1; i < key->len; ++i) {
  107. A = (A >> 32) + (uint64_t)a * b[i] + c[i];
  108. B = (B >> 32) + (uint64_t)d0 * key->n[i] + (uint32_t)A;
  109. c[i - 1] = (uint32_t)B;
  110. }
  111. A = (A >> 32) + (B >> 32);
  112. c[i - 1] = (uint32_t)A;
  113. if (A >> 32) {
  114. subM(key, c);
  115. }
  116. }
  117. /* montgomery c[] = a[] * b[] / R % mod */
  118. static void montMul(const IAvbKey* key, uint32_t* c, uint32_t* a, uint32_t* b) {
  119. uint32_t i;
  120. for (i = 0; i < key->len; ++i) {
  121. c[i] = 0;
  122. }
  123. for (i = 0; i < key->len; ++i) {
  124. montMulAdd(key, c, a[i], b);
  125. }
  126. }
  127. /* In-place public exponentiation. (65537}
  128. * Input and output big-endian byte array in inout.
  129. */
  130. static void modpowF4(const IAvbKey* key, uint8_t* inout) {
  131. uint32_t* a = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
  132. uint32_t* aR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
  133. uint32_t* aaR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));
  134. if (a == NULL || aR == NULL || aaR == NULL) {
  135. goto out;
  136. }
  137. uint32_t* aaa = aaR; /* Re-use location. */
  138. int i;
  139. /* Convert from big endian byte array to little endian word array. */
  140. for (i = 0; i < (int)key->len; ++i) {
  141. uint32_t tmp = (inout[((key->len - 1 - i) * 4) + 0] << 24) |
  142. (inout[((key->len - 1 - i) * 4) + 1] << 16) |
  143. (inout[((key->len - 1 - i) * 4) + 2] << 8) |
  144. (inout[((key->len - 1 - i) * 4) + 3] << 0);
  145. a[i] = tmp;
  146. }
  147. montMul(key, aR, a, key->rr); /* aR = a * RR / R mod M */
  148. for (i = 0; i < 16; i += 2) {
  149. montMul(key, aaR, aR, aR); /* aaR = aR * aR / R mod M */
  150. montMul(key, aR, aaR, aaR); /* aR = aaR * aaR / R mod M */
  151. }
  152. montMul(key, aaa, aR, a); /* aaa = aR * a / R mod M */
  153. /* Make sure aaa < mod; aaa is at most 1x mod too large. */
  154. if (geM(key, aaa)) {
  155. subM(key, aaa);
  156. }
  157. /* Convert to bigendian byte array */
  158. for (i = (int)key->len - 1; i >= 0; --i) {
  159. uint32_t tmp = aaa[i];
  160. *inout++ = (uint8_t)(tmp >> 24);
  161. *inout++ = (uint8_t)(tmp >> 16);
  162. *inout++ = (uint8_t)(tmp >> 8);
  163. *inout++ = (uint8_t)(tmp >> 0);
  164. }
  165. out:
  166. if (a != NULL) {
  167. avb_free(a);
  168. }
  169. if (aR != NULL) {
  170. avb_free(aR);
  171. }
  172. if (aaR != NULL) {
  173. avb_free(aaR);
  174. }
  175. }
  176. /* Verify a RSA PKCS1.5 signature against an expected hash.
  177. * Returns false on failure, true on success.
  178. */
  179. bool avb_rsa_verify(const uint8_t* key,
  180. size_t key_num_bytes,
  181. const uint8_t* sig,
  182. size_t sig_num_bytes,
  183. const uint8_t* hash,
  184. size_t hash_num_bytes,
  185. const uint8_t* padding,
  186. size_t padding_num_bytes) {
  187. uint8_t* buf = NULL;
  188. IAvbKey* parsed_key = NULL;
  189. bool success = false;
  190. if (key == NULL || sig == NULL || hash == NULL || padding == NULL) {
  191. avb_error("Invalid input.\n");
  192. goto out;
  193. }
  194. parsed_key = iavb_parse_key_data(key, key_num_bytes);
  195. if (parsed_key == NULL) {
  196. avb_error("Error parsing key.\n");
  197. goto out;
  198. }
  199. if (sig_num_bytes != (parsed_key->len * sizeof(uint32_t))) {
  200. avb_error("Signature length does not match key length.\n");
  201. goto out;
  202. }
  203. if (padding_num_bytes != sig_num_bytes - hash_num_bytes) {
  204. avb_error("Padding length does not match hash and signature lengths.\n");
  205. goto out;
  206. }
  207. buf = (uint8_t*)avb_malloc(sig_num_bytes);
  208. if (buf == NULL) {
  209. avb_error("Error allocating memory.\n");
  210. goto out;
  211. }
  212. avb_memcpy(buf, sig, sig_num_bytes);
  213. modpowF4(parsed_key, buf);
  214. /* Check padding bytes.
  215. *
  216. * Even though there are probably no timing issues here, we use
  217. * avb_safe_memcmp() just to be on the safe side.
  218. */
  219. if (avb_safe_memcmp(buf, padding, padding_num_bytes)) {
  220. avb_error("Padding check failed.\n");
  221. goto out;
  222. }
  223. /* Check hash. */
  224. if (avb_safe_memcmp(buf + padding_num_bytes, hash, hash_num_bytes)) {
  225. avb_error("Hash check failed.\n");
  226. goto out;
  227. }
  228. success = true;
  229. out:
  230. if (parsed_key != NULL) {
  231. iavb_free_parsed_key(parsed_key);
  232. }
  233. if (buf != NULL) {
  234. avb_free(buf);
  235. }
  236. return success;
  237. }