rsa-verify.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2013, Google Inc.
  4. */
  5. #ifndef USE_HOSTCC
  6. #include <common.h>
  7. #include <fdtdec.h>
  8. #include <log.h>
  9. #include <malloc.h>
  10. #include <asm/types.h>
  11. #include <asm/byteorder.h>
  12. #include <linux/errno.h>
  13. #include <asm/types.h>
  14. #include <asm/unaligned.h>
  15. #include <dm.h>
  16. #else
  17. #include "fdt_host.h"
  18. #include "mkimage.h"
  19. #include <fdt_support.h>
  20. #endif
  21. #include <linux/kconfig.h>
  22. #include <u-boot/rsa-mod-exp.h>
  23. #include <u-boot/rsa.h>
  24. #ifndef __UBOOT__
  25. /*
  26. * NOTE:
  27. * Since host tools, like mkimage, make use of openssl library for
  28. * RSA encryption, rsa_verify_with_pkey()/rsa_gen_key_prop() are
  29. * of no use and should not be compiled in.
  30. * So just turn off CONFIG_RSA_VERIFY_WITH_PKEY.
  31. */
  32. #undef CONFIG_RSA_VERIFY_WITH_PKEY
  33. #endif
  34. /* Default public exponent for backward compatibility */
  35. #define RSA_DEFAULT_PUBEXP 65537
  36. /**
  37. * rsa_verify_padding() - Verify RSA message padding is valid
  38. *
  39. * Verify a RSA message's padding is consistent with PKCS1.5
  40. * padding as described in the RSA PKCS#1 v2.1 standard.
  41. *
  42. * @msg: Padded message
  43. * @pad_len: Number of expected padding bytes
  44. * @algo: Checksum algo structure having information on DER encoding etc.
  45. * @return 0 on success, != 0 on failure
  46. */
  47. static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
  48. struct checksum_algo *algo)
  49. {
  50. int ff_len;
  51. int ret;
  52. /* first byte must be 0x00 */
  53. ret = *msg++;
  54. /* second byte must be 0x01 */
  55. ret |= *msg++ ^ 0x01;
  56. /* next ff_len bytes must be 0xff */
  57. ff_len = pad_len - algo->der_len - 3;
  58. ret |= *msg ^ 0xff;
  59. ret |= memcmp(msg, msg+1, ff_len-1);
  60. msg += ff_len;
  61. /* next byte must be 0x00 */
  62. ret |= *msg++;
  63. /* next der_len bytes must match der_prefix */
  64. ret |= memcmp(msg, algo->der_prefix, algo->der_len);
  65. return ret;
  66. }
  67. int padding_pkcs_15_verify(struct image_sign_info *info,
  68. uint8_t *msg, int msg_len,
  69. const uint8_t *hash, int hash_len)
  70. {
  71. struct checksum_algo *checksum = info->checksum;
  72. int ret, pad_len = msg_len - checksum->checksum_len;
  73. /* Check pkcs1.5 padding bytes. */
  74. ret = rsa_verify_padding(msg, pad_len, checksum);
  75. if (ret) {
  76. debug("In RSAVerify(): Padding check failed!\n");
  77. return -EINVAL;
  78. }
  79. /* Check hash. */
  80. if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) {
  81. debug("In RSAVerify(): Hash check failed!\n");
  82. return -EACCES;
  83. }
  84. return 0;
  85. }
  86. #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT
  87. static void u32_i2osp(uint32_t val, uint8_t *buf)
  88. {
  89. buf[0] = (uint8_t)((val >> 24) & 0xff);
  90. buf[1] = (uint8_t)((val >> 16) & 0xff);
  91. buf[2] = (uint8_t)((val >> 8) & 0xff);
  92. buf[3] = (uint8_t)((val >> 0) & 0xff);
  93. }
  94. /**
  95. * mask_generation_function1() - generate an octet string
  96. *
  97. * Generate an octet string used to check rsa signature.
  98. * It use an input octet string and a hash function.
  99. *
  100. * @checksum: A Hash function
  101. * @seed: Specifies an input variable octet string
  102. * @seed_len: Size of the input octet string
  103. * @output: Specifies the output octet string
  104. * @output_len: Size of the output octet string
  105. * @return 0 if the octet string was correctly generated, others on error
  106. */
  107. static int mask_generation_function1(struct checksum_algo *checksum,
  108. uint8_t *seed, int seed_len,
  109. uint8_t *output, int output_len)
  110. {
  111. struct image_region region[2];
  112. int ret = 0, i, i_output = 0, region_count = 2;
  113. uint32_t counter = 0;
  114. uint8_t buf_counter[4], *tmp;
  115. int hash_len = checksum->checksum_len;
  116. memset(output, 0, output_len);
  117. region[0].data = seed;
  118. region[0].size = seed_len;
  119. region[1].data = &buf_counter[0];
  120. region[1].size = 4;
  121. tmp = malloc(hash_len);
  122. if (!tmp) {
  123. debug("%s: can't allocate array tmp\n", __func__);
  124. ret = -ENOMEM;
  125. goto out;
  126. }
  127. while (i_output < output_len) {
  128. u32_i2osp(counter, &buf_counter[0]);
  129. ret = checksum->calculate(checksum->name,
  130. region, region_count,
  131. tmp);
  132. if (ret < 0) {
  133. debug("%s: Error in checksum calculation\n", __func__);
  134. goto out;
  135. }
  136. i = 0;
  137. while ((i_output < output_len) && (i < hash_len)) {
  138. output[i_output] = tmp[i];
  139. i_output++;
  140. i++;
  141. }
  142. counter++;
  143. }
  144. out:
  145. free(tmp);
  146. return ret;
  147. }
  148. static int compute_hash_prime(struct checksum_algo *checksum,
  149. uint8_t *pad, int pad_len,
  150. uint8_t *hash, int hash_len,
  151. uint8_t *salt, int salt_len,
  152. uint8_t *hprime)
  153. {
  154. struct image_region region[3];
  155. int ret, region_count = 3;
  156. region[0].data = pad;
  157. region[0].size = pad_len;
  158. region[1].data = hash;
  159. region[1].size = hash_len;
  160. region[2].data = salt;
  161. region[2].size = salt_len;
  162. ret = checksum->calculate(checksum->name, region, region_count, hprime);
  163. if (ret < 0) {
  164. debug("%s: Error in checksum calculation\n", __func__);
  165. goto out;
  166. }
  167. out:
  168. return ret;
  169. }
  170. /*
  171. * padding_pss_verify() - verify the pss padding of a signature
  172. *
  173. * Only works with a rsa_pss_saltlen:-2 (default value) right now
  174. * saltlen:-1 "set the salt length to the digest length" is currently
  175. * not supported.
  176. *
  177. * @info: Specifies key and FIT information
  178. * @msg: byte array of message, len equal to msg_len
  179. * @msg_len: Message length
  180. * @hash: Pointer to the expected hash
  181. * @hash_len: Length of the hash
  182. */
  183. int padding_pss_verify(struct image_sign_info *info,
  184. uint8_t *msg, int msg_len,
  185. const uint8_t *hash, int hash_len)
  186. {
  187. uint8_t *masked_db = NULL;
  188. int masked_db_len = msg_len - hash_len - 1;
  189. uint8_t *h = NULL, *hprime = NULL;
  190. int h_len = hash_len;
  191. uint8_t *db_mask = NULL;
  192. int db_mask_len = masked_db_len;
  193. uint8_t *db = NULL, *salt = NULL;
  194. int db_len = masked_db_len, salt_len = msg_len - hash_len - 2;
  195. uint8_t pad_zero[8] = { 0 };
  196. int ret, i, leftmost_bits = 1;
  197. uint8_t leftmost_mask;
  198. struct checksum_algo *checksum = info->checksum;
  199. /* first, allocate everything */
  200. masked_db = malloc(masked_db_len);
  201. h = malloc(h_len);
  202. db_mask = malloc(db_mask_len);
  203. db = malloc(db_len);
  204. salt = malloc(salt_len);
  205. hprime = malloc(hash_len);
  206. if (!masked_db || !h || !db_mask || !db || !salt || !hprime) {
  207. printf("%s: can't allocate some buffer\n", __func__);
  208. ret = -ENOMEM;
  209. goto out;
  210. }
  211. /* step 4: check if the last byte is 0xbc */
  212. if (msg[msg_len - 1] != 0xbc) {
  213. printf("%s: invalid pss padding (0xbc is missing)\n", __func__);
  214. ret = -EINVAL;
  215. goto out;
  216. }
  217. /* step 5 */
  218. memcpy(masked_db, msg, masked_db_len);
  219. memcpy(h, msg + masked_db_len, h_len);
  220. /* step 6 */
  221. leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits);
  222. if (masked_db[0] & leftmost_mask) {
  223. printf("%s: invalid pss padding ", __func__);
  224. printf("(leftmost bit of maskedDB not zero)\n");
  225. ret = -EINVAL;
  226. goto out;
  227. }
  228. /* step 7 */
  229. mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len);
  230. /* step 8 */
  231. for (i = 0; i < db_len; i++)
  232. db[i] = masked_db[i] ^ db_mask[i];
  233. /* step 9 */
  234. db[0] &= 0xff >> leftmost_bits;
  235. /* step 10 */
  236. if (db[0] != 0x01) {
  237. printf("%s: invalid pss padding ", __func__);
  238. printf("(leftmost byte of db isn't 0x01)\n");
  239. ret = EINVAL;
  240. goto out;
  241. }
  242. /* step 11 */
  243. memcpy(salt, &db[1], salt_len);
  244. /* step 12 & 13 */
  245. compute_hash_prime(checksum, pad_zero, 8,
  246. (uint8_t *)hash, hash_len,
  247. salt, salt_len, hprime);
  248. /* step 14 */
  249. ret = memcmp(h, hprime, hash_len);
  250. out:
  251. free(hprime);
  252. free(salt);
  253. free(db);
  254. free(db_mask);
  255. free(h);
  256. free(masked_db);
  257. return ret;
  258. }
  259. #endif
  260. #if CONFIG_IS_ENABLED(FIT_SIGNATURE) || CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
  261. /**
  262. * rsa_verify_key() - Verify a signature against some data using RSA Key
  263. *
  264. * Verify a RSA PKCS1.5 signature against an expected hash using
  265. * the RSA Key properties in prop structure.
  266. *
  267. * @info: Specifies key and FIT information
  268. * @prop: Specifies key
  269. * @sig: Signature
  270. * @sig_len: Number of bytes in signature
  271. * @hash: Pointer to the expected hash
  272. * @key_len: Number of bytes in rsa key
  273. * @return 0 if verified, -ve on error
  274. */
  275. static int rsa_verify_key(struct image_sign_info *info,
  276. struct key_prop *prop, const uint8_t *sig,
  277. const uint32_t sig_len, const uint8_t *hash,
  278. const uint32_t key_len)
  279. {
  280. int ret;
  281. #if !defined(USE_HOSTCC)
  282. struct udevice *mod_exp_dev;
  283. #endif
  284. struct checksum_algo *checksum = info->checksum;
  285. struct padding_algo *padding = info->padding;
  286. int hash_len;
  287. if (!prop || !sig || !hash || !checksum)
  288. return -EIO;
  289. if (sig_len != (prop->num_bits / 8)) {
  290. debug("Signature is of incorrect length %d\n", sig_len);
  291. return -EINVAL;
  292. }
  293. debug("Checksum algorithm: %s", checksum->name);
  294. /* Sanity check for stack size */
  295. if (sig_len > RSA_MAX_SIG_BITS / 8) {
  296. debug("Signature length %u exceeds maximum %d\n", sig_len,
  297. RSA_MAX_SIG_BITS / 8);
  298. return -EINVAL;
  299. }
  300. uint8_t buf[sig_len];
  301. hash_len = checksum->checksum_len;
  302. #if !defined(USE_HOSTCC)
  303. ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
  304. if (ret) {
  305. printf("RSA: Can't find Modular Exp implementation\n");
  306. return -EINVAL;
  307. }
  308. ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
  309. #else
  310. ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
  311. #endif
  312. if (ret) {
  313. debug("Error in Modular exponentation\n");
  314. return ret;
  315. }
  316. ret = padding->verify(info, buf, key_len, hash, hash_len);
  317. if (ret) {
  318. debug("In RSAVerify(): padding check failed!\n");
  319. return ret;
  320. }
  321. return 0;
  322. }
  323. #endif
  324. #if CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
  325. /**
  326. * rsa_verify_with_pkey() - Verify a signature against some data using
  327. * only modulus and exponent as RSA key properties.
  328. * @info: Specifies key information
  329. * @hash: Pointer to the expected hash
  330. * @sig: Signature
  331. * @sig_len: Number of bytes in signature
  332. *
  333. * Parse a RSA public key blob in DER format pointed to in @info and fill
  334. * a key_prop structure with properties of the key. Then verify a RSA PKCS1.5
  335. * signature against an expected hash using the calculated properties.
  336. *
  337. * Return 0 if verified, -ve on error
  338. */
  339. int rsa_verify_with_pkey(struct image_sign_info *info,
  340. const void *hash, uint8_t *sig, uint sig_len)
  341. {
  342. struct key_prop *prop;
  343. int ret;
  344. /* Public key is self-described to fill key_prop */
  345. ret = rsa_gen_key_prop(info->key, info->keylen, &prop);
  346. if (ret) {
  347. debug("Generating necessary parameter for decoding failed\n");
  348. return ret;
  349. }
  350. ret = rsa_verify_key(info, prop, sig, sig_len, hash,
  351. info->crypto->key_len);
  352. rsa_free_key_prop(prop);
  353. return ret;
  354. }
  355. #else
  356. int rsa_verify_with_pkey(struct image_sign_info *info,
  357. const void *hash, uint8_t *sig, uint sig_len)
  358. {
  359. return -EACCES;
  360. }
  361. #endif
  362. #if CONFIG_IS_ENABLED(FIT_SIGNATURE)
  363. /**
  364. * rsa_verify_with_keynode() - Verify a signature against some data using
  365. * information in node with prperties of RSA Key like modulus, exponent etc.
  366. *
  367. * Parse sign-node and fill a key_prop structure with properties of the
  368. * key. Verify a RSA PKCS1.5 signature against an expected hash using
  369. * the properties parsed
  370. *
  371. * @info: Specifies key and FIT information
  372. * @hash: Pointer to the expected hash
  373. * @sig: Signature
  374. * @sig_len: Number of bytes in signature
  375. * @node: Node having the RSA Key properties
  376. * @return 0 if verified, -ve on error
  377. */
  378. static int rsa_verify_with_keynode(struct image_sign_info *info,
  379. const void *hash, uint8_t *sig,
  380. uint sig_len, int node)
  381. {
  382. const void *blob = info->fdt_blob;
  383. struct key_prop prop;
  384. int length;
  385. int ret = 0;
  386. if (node < 0) {
  387. debug("%s: Skipping invalid node", __func__);
  388. return -EBADF;
  389. }
  390. prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
  391. prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
  392. prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
  393. if (!prop.public_exponent || length < sizeof(uint64_t))
  394. prop.public_exponent = NULL;
  395. prop.exp_len = sizeof(uint64_t);
  396. prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
  397. prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
  398. if (!prop.num_bits || !prop.modulus || !prop.rr) {
  399. debug("%s: Missing RSA key info", __func__);
  400. return -EFAULT;
  401. }
  402. ret = rsa_verify_key(info, &prop, sig, sig_len, hash,
  403. info->crypto->key_len);
  404. return ret;
  405. }
  406. #else
  407. static int rsa_verify_with_keynode(struct image_sign_info *info,
  408. const void *hash, uint8_t *sig,
  409. uint sig_len, int node)
  410. {
  411. return -EACCES;
  412. }
  413. #endif
  414. int rsa_verify_hash(struct image_sign_info *info,
  415. const uint8_t *hash, uint8_t *sig, uint sig_len)
  416. {
  417. int ret = -EACCES;
  418. if (CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY) && !info->fdt_blob) {
  419. /* don't rely on fdt properties */
  420. ret = rsa_verify_with_pkey(info, hash, sig, sig_len);
  421. return ret;
  422. }
  423. if (CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
  424. const void *blob = info->fdt_blob;
  425. int ndepth, noffset;
  426. int sig_node, node;
  427. char name[100];
  428. sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
  429. if (sig_node < 0) {
  430. debug("%s: No signature node found\n", __func__);
  431. return -ENOENT;
  432. }
  433. /* See if we must use a particular key */
  434. if (info->required_keynode != -1) {
  435. ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
  436. info->required_keynode);
  437. return ret;
  438. }
  439. /* Look for a key that matches our hint */
  440. snprintf(name, sizeof(name), "key-%s", info->keyname);
  441. node = fdt_subnode_offset(blob, sig_node, name);
  442. ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
  443. if (!ret)
  444. return ret;
  445. /* No luck, so try each of the keys in turn */
  446. for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node,
  447. &ndepth);
  448. (noffset >= 0) && (ndepth > 0);
  449. noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
  450. if (ndepth == 1 && noffset != node) {
  451. ret = rsa_verify_with_keynode(info, hash,
  452. sig, sig_len,
  453. noffset);
  454. if (!ret)
  455. break;
  456. }
  457. }
  458. }
  459. return ret;
  460. }
  461. int rsa_verify(struct image_sign_info *info,
  462. const struct image_region region[], int region_count,
  463. uint8_t *sig, uint sig_len)
  464. {
  465. /* Reserve memory for maximum checksum-length */
  466. uint8_t hash[info->crypto->key_len];
  467. int ret = -EACCES;
  468. /*
  469. * Verify that the checksum-length does not exceed the
  470. * rsa-signature-length
  471. */
  472. if (info->checksum->checksum_len >
  473. info->crypto->key_len) {
  474. debug("%s: invlaid checksum-algorithm %s for %s\n",
  475. __func__, info->checksum->name, info->crypto->name);
  476. return -EINVAL;
  477. }
  478. /* Calculate checksum with checksum-algorithm */
  479. ret = info->checksum->calculate(info->checksum->name,
  480. region, region_count, hash);
  481. if (ret < 0) {
  482. debug("%s: Error in checksum calculation\n", __func__);
  483. return -EINVAL;
  484. }
  485. return rsa_verify_hash(info, hash, sig, sig_len);
  486. }