rsa-verify.c 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2013, Google Inc.
  4. */
  5. #ifndef USE_HOSTCC
  6. #include <common.h>
  7. #include <fdtdec.h>
  8. #include <asm/types.h>
  9. #include <asm/byteorder.h>
  10. #include <linux/errno.h>
  11. #include <asm/types.h>
  12. #include <asm/unaligned.h>
  13. #include <dm.h>
  14. #else
  15. #include "fdt_host.h"
  16. #include "mkimage.h"
  17. #include <fdt_support.h>
  18. #endif
  19. #include <u-boot/rsa-mod-exp.h>
  20. #include <u-boot/rsa.h>
  21. /* Default public exponent for backward compatibility */
  22. #define RSA_DEFAULT_PUBEXP 65537
  23. /**
  24. * rsa_verify_padding() - Verify RSA message padding is valid
  25. *
  26. * Verify a RSA message's padding is consistent with PKCS1.5
  27. * padding as described in the RSA PKCS#1 v2.1 standard.
  28. *
  29. * @msg: Padded message
  30. * @pad_len: Number of expected padding bytes
  31. * @algo: Checksum algo structure having information on DER encoding etc.
  32. * @return 0 on success, != 0 on failure
  33. */
  34. static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
  35. struct checksum_algo *algo)
  36. {
  37. int ff_len;
  38. int ret;
  39. /* first byte must be 0x00 */
  40. ret = *msg++;
  41. /* second byte must be 0x01 */
  42. ret |= *msg++ ^ 0x01;
  43. /* next ff_len bytes must be 0xff */
  44. ff_len = pad_len - algo->der_len - 3;
  45. ret |= *msg ^ 0xff;
  46. ret |= memcmp(msg, msg+1, ff_len-1);
  47. msg += ff_len;
  48. /* next byte must be 0x00 */
  49. ret |= *msg++;
  50. /* next der_len bytes must match der_prefix */
  51. ret |= memcmp(msg, algo->der_prefix, algo->der_len);
  52. return ret;
  53. }
  54. int padding_pkcs_15_verify(struct image_sign_info *info,
  55. uint8_t *msg, int msg_len,
  56. const uint8_t *hash, int hash_len)
  57. {
  58. struct checksum_algo *checksum = info->checksum;
  59. int ret, pad_len = msg_len - checksum->checksum_len;
  60. /* Check pkcs1.5 padding bytes. */
  61. ret = rsa_verify_padding(msg, pad_len, checksum);
  62. if (ret) {
  63. debug("In RSAVerify(): Padding check failed!\n");
  64. return -EINVAL;
  65. }
  66. /* Check hash. */
  67. if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) {
  68. debug("In RSAVerify(): Hash check failed!\n");
  69. return -EACCES;
  70. }
  71. return 0;
  72. }
  73. /**
  74. * rsa_verify_key() - Verify a signature against some data using RSA Key
  75. *
  76. * Verify a RSA PKCS1.5 signature against an expected hash using
  77. * the RSA Key properties in prop structure.
  78. *
  79. * @info: Specifies key and FIT information
  80. * @prop: Specifies key
  81. * @sig: Signature
  82. * @sig_len: Number of bytes in signature
  83. * @hash: Pointer to the expected hash
  84. * @key_len: Number of bytes in rsa key
  85. * @return 0 if verified, -ve on error
  86. */
  87. static int rsa_verify_key(struct image_sign_info *info,
  88. struct key_prop *prop, const uint8_t *sig,
  89. const uint32_t sig_len, const uint8_t *hash,
  90. const uint32_t key_len)
  91. {
  92. int ret;
  93. #if !defined(USE_HOSTCC)
  94. struct udevice *mod_exp_dev;
  95. #endif
  96. struct checksum_algo *checksum = info->checksum;
  97. struct padding_algo *padding = info->padding;
  98. int hash_len = checksum->checksum_len;
  99. if (!prop || !sig || !hash || !checksum)
  100. return -EIO;
  101. if (sig_len != (prop->num_bits / 8)) {
  102. debug("Signature is of incorrect length %d\n", sig_len);
  103. return -EINVAL;
  104. }
  105. debug("Checksum algorithm: %s", checksum->name);
  106. /* Sanity check for stack size */
  107. if (sig_len > RSA_MAX_SIG_BITS / 8) {
  108. debug("Signature length %u exceeds maximum %d\n", sig_len,
  109. RSA_MAX_SIG_BITS / 8);
  110. return -EINVAL;
  111. }
  112. uint8_t buf[sig_len];
  113. #if !defined(USE_HOSTCC)
  114. ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
  115. if (ret) {
  116. printf("RSA: Can't find Modular Exp implementation\n");
  117. return -EINVAL;
  118. }
  119. ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
  120. #else
  121. ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
  122. #endif
  123. if (ret) {
  124. debug("Error in Modular exponentation\n");
  125. return ret;
  126. }
  127. ret = padding->verify(info, buf, key_len, hash, hash_len);
  128. if (ret) {
  129. debug("In RSAVerify(): padding check failed!\n");
  130. return ret;
  131. }
  132. return 0;
  133. }
  134. /**
  135. * rsa_verify_with_keynode() - Verify a signature against some data using
  136. * information in node with prperties of RSA Key like modulus, exponent etc.
  137. *
  138. * Parse sign-node and fill a key_prop structure with properties of the
  139. * key. Verify a RSA PKCS1.5 signature against an expected hash using
  140. * the properties parsed
  141. *
  142. * @info: Specifies key and FIT information
  143. * @hash: Pointer to the expected hash
  144. * @sig: Signature
  145. * @sig_len: Number of bytes in signature
  146. * @node: Node having the RSA Key properties
  147. * @return 0 if verified, -ve on error
  148. */
  149. static int rsa_verify_with_keynode(struct image_sign_info *info,
  150. const void *hash, uint8_t *sig,
  151. uint sig_len, int node)
  152. {
  153. const void *blob = info->fdt_blob;
  154. struct key_prop prop;
  155. int length;
  156. int ret = 0;
  157. if (node < 0) {
  158. debug("%s: Skipping invalid node", __func__);
  159. return -EBADF;
  160. }
  161. prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
  162. prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
  163. prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
  164. if (!prop.public_exponent || length < sizeof(uint64_t))
  165. prop.public_exponent = NULL;
  166. prop.exp_len = sizeof(uint64_t);
  167. prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
  168. prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
  169. if (!prop.num_bits || !prop.modulus) {
  170. debug("%s: Missing RSA key info", __func__);
  171. return -EFAULT;
  172. }
  173. ret = rsa_verify_key(info, &prop, sig, sig_len, hash,
  174. info->crypto->key_len);
  175. return ret;
  176. }
  177. int rsa_verify(struct image_sign_info *info,
  178. const struct image_region region[], int region_count,
  179. uint8_t *sig, uint sig_len)
  180. {
  181. const void *blob = info->fdt_blob;
  182. /* Reserve memory for maximum checksum-length */
  183. uint8_t hash[info->crypto->key_len];
  184. int ndepth, noffset;
  185. int sig_node, node;
  186. char name[100];
  187. int ret;
  188. /*
  189. * Verify that the checksum-length does not exceed the
  190. * rsa-signature-length
  191. */
  192. if (info->checksum->checksum_len >
  193. info->crypto->key_len) {
  194. debug("%s: invlaid checksum-algorithm %s for %s\n",
  195. __func__, info->checksum->name, info->crypto->name);
  196. return -EINVAL;
  197. }
  198. sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
  199. if (sig_node < 0) {
  200. debug("%s: No signature node found\n", __func__);
  201. return -ENOENT;
  202. }
  203. /* Calculate checksum with checksum-algorithm */
  204. ret = info->checksum->calculate(info->checksum->name,
  205. region, region_count, hash);
  206. if (ret < 0) {
  207. debug("%s: Error in checksum calculation\n", __func__);
  208. return -EINVAL;
  209. }
  210. /* See if we must use a particular key */
  211. if (info->required_keynode != -1) {
  212. ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
  213. info->required_keynode);
  214. if (!ret)
  215. return ret;
  216. }
  217. /* Look for a key that matches our hint */
  218. snprintf(name, sizeof(name), "key-%s", info->keyname);
  219. node = fdt_subnode_offset(blob, sig_node, name);
  220. ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
  221. if (!ret)
  222. return ret;
  223. /* No luck, so try each of the keys in turn */
  224. for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
  225. (noffset >= 0) && (ndepth > 0);
  226. noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
  227. if (ndepth == 1 && noffset != node) {
  228. ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
  229. noffset);
  230. if (!ret)
  231. break;
  232. }
  233. }
  234. return ret;
  235. }