• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2022 Huawei Technologies Co., Ltd.
3  * Licensed under the Mulan PSL v2.
4  * You can use this software according to the terms and conditions of the Mulan PSL v2.
5  * You may obtain a copy of Mulan PSL v2 at:
6  *     http://license.coscl.org.cn/MulanPSL2
7  * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
8  * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
9  * PURPOSE.
10  * See the Mulan PSL v2 for more details.
11  */
12 
13 #include "soft_rsa_api.h"
14 #include <openssl/rsa.h>
15 #include <openssl/bn.h>
16 #include <openssl/evp.h>
17 #include <securec.h>
18 #include <tee_log.h>
19 #include <tee_mem_mgmt_api.h>
20 #include "soft_common_api.h"
21 #include "soft_err.h"
22 
23 #define UINT8_SHIFT                  8
24 #define MD5_LEN                      16
25 #define SHA1_LEN                     20
26 #define SHA224_LEN                   28
27 #define SHA256_LEN                   32
28 #define SHA384_LEN                   48
29 #define SHA512_LEN                   64
30 #define MAX_SOFT_ASYMMETRIC_KEY_SIZE 4096
31 
32 struct rsa_priv_key_bignum_t {
33     BIGNUM *bn_n;
34     BIGNUM *bn_e;
35     BIGNUM *bn_d;
36     BIGNUM *bn_p;
37     BIGNUM *bn_q;
38     BIGNUM *bn_dp;
39     BIGNUM *bn_dq;
40     BIGNUM *bn_qinv;
41     BIGNUM *bn_div;
42     BIGNUM *bn_gcd;
43 };
44 
45 struct create_rsa_crypt_ctx_t {
46     uint32_t alg_type;
47     uint32_t mode;
48     int32_t padding;
49 };
50 
uint8_to_uint32(const uint8_t * buffer,uint32_t size,uint32_t * result)51 static void uint8_to_uint32(const uint8_t *buffer, uint32_t size, uint32_t *result)
52 {
53     bool check = ((buffer == NULL) || (size == 0) || (size > UINT32_SHIFT_MAX));
54     if (check)
55         return;
56     uint32_t shift = 0;
57     *result = 0;
58     for (int32_t i = (int32_t)(size - 1); i >= 0; i--) {
59         *result += (uint32_t)buffer[i] << shift;
60         shift += UINT8_SHIFT;
61     }
62     return;
63 }
64 
generate_boring_rsa_key(uint32_t key_size,uint32_t exponent)65 static RSA *generate_boring_rsa_key(uint32_t key_size, uint32_t exponent)
66 {
67     RSA *rsa_key = RSA_new();
68     if (rsa_key == NULL) {
69         tloge("New rsa key structfailed\n");
70         return NULL;
71     }
72     BIGNUM *bn_e = BN_new();
73     if (bn_e == NULL) {
74         tloge("New big num e failed\n");
75         RSA_free(rsa_key);
76         return NULL;
77     }
78     if (key_size > UINT32_MAX / BIT_TO_BYTE) {
79         tloge("Key size is not valid, key_size=0x%x\n", key_size);
80         BN_free(bn_e);
81         RSA_free(rsa_key);
82         return NULL;
83     }
84 
85     int32_t ret1;
86     if (exponent == 0)
87         ret1 = BN_set_word(bn_e, RSA_F4);
88     else
89         ret1 = BN_set_word(bn_e, exponent);
90 
91     int32_t ret2 = RSA_generate_key_ex(rsa_key, key_size * BIT_TO_BYTE, bn_e, NULL);
92     BN_free(bn_e);
93     if ((ret1 != 1) || (ret2 != 1)) {
94         tloge("Set big num e value or generate rsa key pair failed\n");
95         RSA_free(rsa_key);
96         return NULL;
97     }
98 
99     return rsa_key;
100 }
101 
convert_big_num_to_buffer(const BIGNUM * big_num,uint8_t * out,uint32_t * out_len)102 static int32_t convert_big_num_to_buffer(const BIGNUM *big_num, uint8_t *out, uint32_t *out_len)
103 {
104     bool check = ((big_num == NULL) || (out == NULL) || (out_len == NULL));
105     if (check) {
106         tloge("Invalid param in convert big num to buffer\n");
107         return CRYPTO_BAD_PARAMETERS;
108     }
109 
110     uint32_t big_num_len = (uint32_t)BN_num_bytes(big_num);
111     if (*out_len < big_num_len) {
112         tloge("The out length is less than big num length, out_len=%u, big_num_len=%u\n", *out_len, big_num_len);
113         return CRYPTO_BAD_PARAMETERS;
114     }
115 
116     uint8_t *rsa_buff = (uint8_t *)TEE_Malloc(big_num_len + 1, 0);
117     if (rsa_buff == NULL) {
118         tloge("Malloc memory for big num failed, size=%u\n", big_num_len);
119         return CRYPTO_ERROR_OUT_OF_MEMORY;
120     }
121 
122     size_t write_len = (size_t)BN_bn2bin(big_num, rsa_buff);
123     if (write_len != big_num_len) {
124         tloge("Convert big num to buffer failed, big_num_len=%u, write_len=%zu\n", big_num_len, write_len);
125         TEE_Free(rsa_buff);
126         return CRYPTO_BAD_PARAMETERS;
127     }
128 
129     errno_t rc = memcpy_s(out, *out_len, rsa_buff, big_num_len);
130     TEE_Free(rsa_buff);
131     if (rc != EOK) {
132         tloge("Copy rsa buff to param failed\n");
133         return CRYPTO_ERROR_SECURITY;
134     }
135 
136     *out_len = big_num_len;
137     return CRYPTO_SUCCESS;
138 }
139 
convert_rsa_boring_to_non_crt(const RSA * rsa_key,struct rsa_priv_key_t * key_pair)140 static int32_t convert_rsa_boring_to_non_crt(const RSA *rsa_key, struct rsa_priv_key_t *key_pair)
141 {
142     BIGNUM *bn_n = NULL;
143     BIGNUM *bn_e = NULL;
144     BIGNUM *bn_d = NULL;
145     int32_t i = 0;
146 
147     RSA_get0_key(rsa_key, (const BIGNUM **)&bn_n, (const BIGNUM **)&bn_e, (const BIGNUM **)&bn_d);
148 
149     BIGNUM *bn_array[] = {bn_n, bn_e, bn_d};
150     uint8_t *key[] = {key_pair->n, key_pair->e, key_pair->d};
151     uint32_t *key_len[] = {&(key_pair->n_len), &(key_pair->e_len), &(key_pair->d_len)};
152 
153     for (; i < RSA_KEY_PAIR_ATTRIBUTE_COUNT_NO_CRT; i++) {
154         int32_t ret = convert_big_num_to_buffer(bn_array[i], key[i], key_len[i]);
155         if (ret != CRYPTO_SUCCESS) {
156             tloge("Convert boring rsa key to crt failed, ret=0x%x\n", ret);
157             return CRYPTO_BAD_PARAMETERS;
158         }
159     }
160 
161     return CRYPTO_SUCCESS;
162 }
163 
convert_rsa_boring_to_crt(const RSA * rsa_key,struct rsa_priv_key_t * key_pair)164 static int32_t convert_rsa_boring_to_crt(const RSA *rsa_key, struct rsa_priv_key_t *key_pair)
165 {
166     struct rsa_priv_key_bignum_t key_pair_bignum = {0};
167     int32_t i = 0;
168 
169     RSA_get0_key(rsa_key, (const BIGNUM **)&(key_pair_bignum.bn_n),
170         (const BIGNUM **)&(key_pair_bignum.bn_e), (const BIGNUM **)&(key_pair_bignum.bn_d));
171     RSA_get0_factors(rsa_key, (const BIGNUM **)&(key_pair_bignum.bn_p), (const BIGNUM **)&(key_pair_bignum.bn_q));
172     RSA_get0_crt_params(rsa_key, (const BIGNUM **)&(key_pair_bignum.bn_dp),
173         (const BIGNUM **)&(key_pair_bignum.bn_dq), (const BIGNUM **)&(key_pair_bignum.bn_qinv));
174 
175     BIGNUM *bn_array[] = {key_pair_bignum.bn_n, key_pair_bignum.bn_e, key_pair_bignum.bn_d, key_pair_bignum.bn_p,
176         key_pair_bignum.bn_q, key_pair_bignum.bn_dp, key_pair_bignum.bn_dq, key_pair_bignum.bn_qinv};
177     uint8_t *key[] = {key_pair->n, key_pair->e, key_pair->d, key_pair->p, key_pair->q,
178         key_pair->dp, key_pair->dq, key_pair->qinv};
179     uint32_t *key_len[] = {&(key_pair->n_len), &(key_pair->e_len), &(key_pair->d_len),
180         &(key_pair->p_len), &(key_pair->q_len), &(key_pair->dp_len), &(key_pair->dq_len), &(key_pair->qinv_len)};
181 
182     for (; i < RSA_KEY_PAIR_ATTRIBUTE_COUNT; i++) {
183         int32_t ret = convert_big_num_to_buffer(bn_array[i], key[i], key_len[i]);
184         if (ret != CRYPTO_SUCCESS) {
185             tloge("Convert boring rsa key to crt failed, ret=0x%x\n", ret);
186             return CRYPTO_BAD_PARAMETERS;
187         }
188     }
189 
190     return CRYPTO_SUCCESS;
191 }
192 
soft_gen_rsa_key_pair(uint32_t key_size,uint32_t exponent,bool crt_mode,struct rsa_priv_key_t * key_pair)193 static int32_t soft_gen_rsa_key_pair(uint32_t key_size, uint32_t exponent, bool crt_mode,
194     struct rsa_priv_key_t *key_pair)
195 {
196     int32_t ret;
197     RSA *rsa_key = generate_boring_rsa_key(key_size, exponent);
198     if (rsa_key == NULL) {
199         tloge("Generate boring rsa key failed\n");
200         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
201     }
202 
203     if (crt_mode)
204         ret = convert_rsa_boring_to_crt(rsa_key, key_pair);
205     else
206         ret = convert_rsa_boring_to_non_crt(rsa_key, key_pair);
207 
208     RSA_free(rsa_key);
209     if (ret != CRYPTO_SUCCESS)
210         tloge("Convert boring rsa key to params failed!\n ret = 0x%x\n", ret);
211 
212     key_pair->crt_mode = crt_mode;
213     return ret;
214 }
215 
convert_rsa_padding_to_boring(uint32_t algorithm,int32_t * padding,uint32_t * hash_len)216 static int32_t convert_rsa_padding_to_boring(uint32_t algorithm, int32_t *padding, uint32_t *hash_len)
217 {
218     switch (algorithm) {
219     case CRYPTO_TYPE_RSAES_PKCS1_V1_5:
220         *padding = RSA_PKCS1_PADDING;
221         break;
222     case CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA1:
223         *hash_len = SHA1_LEN;
224         *padding  = RSA_PKCS1_OAEP_PADDING;
225         break;
226     case CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA224:
227         *hash_len = SHA224_LEN;
228         *padding  = RSA_PKCS1_OAEP_PADDING;
229         break;
230     case CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA256:
231         *hash_len = SHA256_LEN;
232         *padding  = RSA_PKCS1_OAEP_PADDING;
233         break;
234     case CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA384:
235         *hash_len = SHA384_LEN;
236         *padding  = RSA_PKCS1_OAEP_PADDING;
237         break;
238     case CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA512:
239         *hash_len = SHA512_LEN;
240         *padding  = RSA_PKCS1_OAEP_PADDING;
241         break;
242     case CRYPTO_TYPE_RSA_NO_PAD:
243         *padding = RSA_NO_PADDING;
244         break;
245     default:
246         tloge("Convert rsa padding: algorithm not supported, algorithm=0x%x\n", algorithm);
247         return CRYPTO_BAD_PARAMETERS;
248     }
249 
250     return CRYPTO_SUCCESS;
251 }
252 
get_mgf1_algorithm(const struct asymmetric_params_t * params)253 static const EVP_MD *get_mgf1_algorithm(const struct asymmetric_params_t *params)
254 {
255     if (params == NULL)
256         return NULL;
257     struct crypto_attribute_t *attribute = (struct crypto_attribute_t *)(uintptr_t)(params->attribute);
258     if (attribute == NULL)
259         return NULL;
260     for (uint32_t i = 0; i < params->param_count; i++) {
261         if (attribute[i].attribute_id == CRYPTO_ATTR_RSA_MGF1_HASH) {
262             switch (attribute[i].content.value.a) {
263             case CRYPTO_TYPE_DIGEST_SHA1:
264                 return EVP_sha1();
265             case CRYPTO_TYPE_DIGEST_SHA224:
266                 return EVP_sha224();
267             case CRYPTO_TYPE_DIGEST_SHA256:
268                 return EVP_sha256();
269             case CRYPTO_TYPE_DIGEST_SHA384:
270                 return EVP_sha384();
271             case CRYPTO_TYPE_DIGEST_SHA512:
272                 return EVP_sha512();
273             default:
274                 return NULL;
275             }
276         }
277     }
278     return NULL;
279 }
280 
get_hash_nid_from_algorithm(uint32_t algorithm,int32_t * hash_nid)281 static int32_t get_hash_nid_from_algorithm(uint32_t algorithm, int32_t *hash_nid)
282 {
283     size_t i = 0;
284     crypto_uint2uint algorithm_to_hash_nid[] = {
285         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_MD5, NID_md5 },
286         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_SHA1, NID_sha1 },
287         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_SHA224, NID_sha224 },
288         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_SHA256, NID_sha256 },
289         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_SHA384, NID_sha384 },
290         { CRYPTO_TYPE_RSASSA_PKCS1_V1_5_SHA512, NID_sha512 },
291         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_MD5, NID_md5 },
292         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA1, NID_sha1 },
293         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA224, NID_sha224 },
294         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA256, NID_sha256 },
295         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA384, NID_sha384 },
296         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA512, NID_sha512 },
297         { CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA1,  NID_sha1 },
298         { CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA224, NID_sha224 },
299         { CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA256, NID_sha256 },
300         { CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA384, NID_sha384 },
301         { CRYPTO_TYPE_RSAES_PKCS1_OAEP_MGF1_SHA512, NID_sha512 }
302     };
303     size_t total_map_num = sizeof(algorithm_to_hash_nid) / sizeof(crypto_uint2uint);
304     for (; i < total_map_num; i++) {
305         if (algorithm_to_hash_nid[i].src == algorithm) {
306             *hash_nid = (int32_t)algorithm_to_hash_nid[i].dest;
307             return CRYPTO_SUCCESS;
308         }
309     }
310 
311     return CRYPTO_BAD_PARAMETERS;
312 }
313 
set_rsa_oaep_padding_hash(const struct asymmetric_params_t * params,uint32_t alg_type,EVP_PKEY_CTX * ctx,int32_t padding)314 static int32_t set_rsa_oaep_padding_hash(const struct asymmetric_params_t *params, uint32_t alg_type,
315     EVP_PKEY_CTX *ctx, int32_t padding)
316 {
317     if (padding != RSA_PKCS1_OAEP_PADDING)
318         return CRYPTO_SUCCESS;
319 
320     int32_t hash_nid = NID_sha1;
321     int32_t ret = get_hash_nid_from_algorithm(alg_type, &hash_nid);
322     if (ret != CRYPTO_SUCCESS) {
323         tloge("Get hash nid from operation algorithm failed\n");
324         return ret;
325     }
326 
327     const EVP_MD *md = EVP_get_digestbynid(hash_nid);
328     if (md == NULL) {
329         tloge("Get evp digest by nid failed, hash_nid=%d\n", hash_nid);
330         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
331     }
332 
333     ret = EVP_PKEY_CTX_set_rsa_oaep_md(ctx, (const void *)md);
334     if (ret != BORINGSSL_OK) {
335         tloge("Evp rsa set oaep md failed\n");
336         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
337     }
338 
339     /* The mgf1 hash is fixed sha1 in dx, so use sha1 for compatible in here */
340     const EVP_MD *evp_md = get_mgf1_algorithm(params);
341     if (evp_md != NULL)
342         ret = EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, (void *)evp_md);
343     else
344         ret = EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, (const void *)EVP_sha1());
345 
346     if (ret != BORINGSSL_OK) {
347         tloge("Evp rsa set mgf1 md failed\n");
348         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
349     }
350 
351     return CRYPTO_SUCCESS;
352 }
353 
set_evp_rsa_ctx_mode(uint32_t mode,EVP_PKEY_CTX * ctx)354 static int32_t set_evp_rsa_ctx_mode(uint32_t mode, EVP_PKEY_CTX *ctx)
355 {
356     if (mode == ENC_MODE) {
357         int32_t rc = EVP_PKEY_encrypt_init(ctx);
358         if (rc != BORINGSSL_OK) {
359             tloge("Evp rsa encrypt init failed\n");
360             return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
361         }
362     } else {
363         int32_t rc = EVP_PKEY_decrypt_init(ctx);
364         if (rc != BORINGSSL_OK) {
365             tloge("Evp rsa decrypt init failed\n");
366             return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
367         }
368     }
369 
370     return CRYPTO_SUCCESS;
371 }
372 
generate_and_init_evp_rsa_ctx(uint32_t alg_type,const struct asymmetric_params_t * params,uint32_t mode,int32_t padding,EVP_PKEY * evp_key)373 static EVP_PKEY_CTX *generate_and_init_evp_rsa_ctx(uint32_t alg_type, const struct asymmetric_params_t *params,
374     uint32_t mode, int32_t padding, EVP_PKEY *evp_key)
375 {
376     EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(evp_key, NULL);
377     if (ctx == NULL) {
378         tloge("Create rsa evp key ctx failed\n");
379         return NULL;
380     }
381 
382     int ret = set_evp_rsa_ctx_mode(mode, ctx);
383     if (ret != CRYPTO_SUCCESS) {
384         tloge("Set evp rsa ctx mode failed\n");
385         goto error;
386     }
387 
388     ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
389     if (ret != BORINGSSL_OK) {
390         tloge("Evp set rsa ctx padding failed\n");
391         goto error;
392     }
393 
394     ret = set_rsa_oaep_padding_hash(params, alg_type, ctx, padding);
395     if (ret != CRYPTO_SUCCESS) {
396         tloge("Set rsa oaep padding failed\n");
397         goto error;
398     }
399 
400     return ctx;
401 error:
402     EVP_PKEY_CTX_free(ctx);
403     return NULL;
404 }
405 
convert_rsa_pub_to_boring(const struct rsa_pub_key_t * public_key)406 static RSA *convert_rsa_pub_to_boring(const struct rsa_pub_key_t *public_key)
407 {
408     if (public_key->n_len > RSA_MAX_KEY_SIZE || public_key->e_len > RSA_EXPONENT_LEN)
409         return NULL;
410 
411     BIGNUM *bn_n = BN_bin2bn(public_key->n, public_key->n_len, NULL);
412     BIGNUM *bn_e = BN_bin2bn(public_key->e, public_key->e_len, NULL);
413     bool check = ((bn_n == NULL) || (bn_e == NULL));
414     if (check) {
415         tloge("Change pub buffer num to big num failed\n");
416         BN_free(bn_n);
417         BN_free(bn_e);
418         return NULL;
419     }
420 
421     RSA *rsa_key = RSA_new();
422     if (rsa_key == NULL) {
423         tloge("Malloc memory for rsa key failed\n");
424         BN_free(bn_n);
425         BN_free(bn_e);
426         return NULL;
427     }
428 
429     int32_t rc = RSA_set0_key(rsa_key, bn_n, bn_e, NULL);
430     if (rc != BORINGSSL_OK) {
431         tloge("Set rsa key failed\n");
432         BN_free(bn_n);
433         BN_free(bn_e);
434         RSA_free(rsa_key);
435         return NULL;
436     }
437 
438     return rsa_key;
439 }
440 
create_rsa_encrypt_ctx(const struct create_rsa_crypt_ctx_t * rsa_encrypt_ctx,const struct asymmetric_params_t * params,const struct rsa_pub_key_t * public_key,EVP_PKEY * evp_key)441 static EVP_PKEY_CTX *create_rsa_encrypt_ctx(const struct create_rsa_crypt_ctx_t *rsa_encrypt_ctx,
442     const struct asymmetric_params_t *params, const struct rsa_pub_key_t *public_key, EVP_PKEY *evp_key)
443 {
444     RSA *rsa_key = convert_rsa_pub_to_boring(public_key);
445     if (rsa_key == NULL) {
446         tloge("Duplicate rsa pub key failed\n");
447         return NULL;
448     }
449     int32_t rc = EVP_PKEY_assign_RSA(evp_key, rsa_key);
450     if (rc != BORINGSSL_OK) {
451         tloge("Evp assign rsa key failed\n");
452         RSA_free(rsa_key);
453         return NULL;
454     }
455     EVP_PKEY_CTX *ctx = generate_and_init_evp_rsa_ctx((rsa_encrypt_ctx->alg_type), params, (rsa_encrypt_ctx->mode),
456         (rsa_encrypt_ctx->padding), evp_key);
457     if (ctx == NULL) {
458         tloge("Create and init rsa evp ctx failed\n");
459         RSA_free(rsa_key);
460         return NULL;
461     }
462 
463     return ctx;
464 }
465 
convert_rsa_non_crt_to_boring(const struct rsa_priv_key_t * private_key)466 static RSA *convert_rsa_non_crt_to_boring(const struct rsa_priv_key_t *private_key)
467 {
468     if (private_key->n_len > RSA_MAX_KEY_SIZE || private_key->d_len > RSA_MAX_KEY_SIZE ||
469         private_key->e_len > RSA_EXPONENT_LEN)
470         return NULL;
471 
472     BIGNUM *bn_n = BN_bin2bn(private_key->n, private_key->n_len, NULL);
473     BIGNUM *bn_e = BN_bin2bn(private_key->e, private_key->e_len, NULL);
474     BIGNUM *bn_d = BN_bin2bn(private_key->d, private_key->d_len, NULL);
475     bool is_abnormal = (bn_n == NULL) || (bn_e == NULL) || (bn_d == NULL);
476     if (is_abnormal) {
477         tloge("Change non crt buffer num to big num failed\n");
478         goto free_bn;
479     }
480     RSA *rsa_key = RSA_new();
481     if (rsa_key == NULL) {
482         tloge("Malloc memory for rsa key failed\n");
483         goto free_bn;
484     }
485     int32_t rc = RSA_set0_key(rsa_key, bn_n, bn_e, bn_d);
486     if (rc != BORINGSSL_OK) {
487         tloge("Set rsa key failed\n");
488         RSA_free(rsa_key);
489         goto free_bn;
490     }
491     return rsa_key;
492 free_bn:
493     BN_free(bn_n);
494     BN_free(bn_e);
495     BN_clear_free(bn_d);
496     return NULL;
497 }
498 
get_rsa_crt_big_num(const struct rsa_priv_key_t * private_key,BIGNUM * bn_array[],uint32_t array_num)499 static int32_t get_rsa_crt_big_num(const struct rsa_priv_key_t *private_key, BIGNUM *bn_array[], uint32_t array_num)
500 {
501     const uint8_t *key_array[RSA_CRT_KEY_ATTRIBUTE_COUNT] = {
502         private_key->p,
503         private_key->q,
504         private_key->dp,
505         private_key->dq,
506         private_key->qinv
507     };
508     uint32_t key_size_array[RSA_CRT_KEY_ATTRIBUTE_COUNT] = {
509         private_key->p_len,
510         private_key->q_len,
511         private_key->dp_len,
512         private_key->dq_len,
513         private_key->qinv_len
514     };
515 
516     uint32_t i = 0;
517     for (; i < array_num; i++) {
518         bn_array[i] = BN_bin2bn(key_array[i], (int32_t)key_size_array[i], NULL);
519         if (bn_array[i] == NULL) {
520             tloge("Change crt buffer num to big num failed\n");
521             return CRYPTO_BAD_PARAMETERS;
522         }
523     }
524 
525     return CRYPTO_SUCCESS;
526 }
527 
528 #define RSA_FACTOR_P_INDEX 0
529 #define RSA_FACTOR_Q_INDEX 1
530 #define RSA_CRT_DMP1       2
531 #define RSA_CRT_DMQ1       3
532 #define RSA_CRT_IQMP       4
set_boring_rsa_key(BIGNUM * bn_n,BIGNUM * bn_e,BIGNUM * bn_d,BIGNUM * bn_array[])533 static RSA *set_boring_rsa_key(BIGNUM *bn_n, BIGNUM *bn_e, BIGNUM *bn_d, BIGNUM *bn_array[])
534 {
535     RSA *rsa_key = RSA_new();
536     if (rsa_key == NULL) {
537         tloge("Malloc memory for rsa key failed\n");
538         return NULL;
539     }
540     int32_t ret1 = RSA_set0_key(rsa_key, bn_n, bn_e, bn_d);
541     int32_t ret2 = RSA_set0_factors(rsa_key, bn_array[RSA_FACTOR_P_INDEX], bn_array[RSA_FACTOR_Q_INDEX]);
542     int32_t ret3 = RSA_set0_crt_params(rsa_key,
543                                        bn_array[RSA_CRT_DMP1],
544                                        bn_array[RSA_CRT_DMQ1],
545                                        bn_array[RSA_CRT_IQMP]);
546     bool is_abnormal = (ret1 != BORINGSSL_OK || ret2 != BORINGSSL_OK || ret3 != BORINGSSL_OK);
547     if (is_abnormal) {
548         tloge("Set rsa key failed, ret1=0x%x, ret2=0x%x, ret3=0x%x\n", ret1, ret2, ret3);
549         RSA_free(rsa_key);
550         return NULL;
551     }
552 
553     return rsa_key;
554 }
555 
compute_rsa_ed_big_num(BIGNUM * bn_p,BIGNUM * bn_q,BN_CTX * ctx,BIGNUM ** bn_e,BIGNUM ** bn_d)556 static int32_t compute_rsa_ed_big_num(BIGNUM *bn_p, BIGNUM *bn_q, BN_CTX *ctx, BIGNUM **bn_e, BIGNUM **bn_d)
557 {
558     struct rsa_priv_key_bignum_t key_pair_bignum = {0};
559     int32_t ret1;
560 
561     key_pair_bignum.bn_p = BN_dup(bn_p);
562     key_pair_bignum.bn_q = BN_dup(bn_q);
563     key_pair_bignum.bn_div = BN_new();
564     key_pair_bignum.bn_gcd = BN_new();
565     bool is_abnormal = (key_pair_bignum.bn_p == NULL) || (key_pair_bignum.bn_q == NULL) ||
566         (key_pair_bignum.bn_div == NULL) || (key_pair_bignum.bn_gcd == NULL);
567     if (is_abnormal) {
568         tloge("Duplicate or new big num failed\n");
569         ret1 = 0;
570         goto error;
571     }
572 
573     ret1 = BN_sub_word(key_pair_bignum.bn_p, 1);
574     int32_t ret2 = BN_sub_word(key_pair_bignum.bn_q, 1);
575     is_abnormal  = (ret1 != 1) || (ret2 != 1);
576     if (is_abnormal) {
577         tloge("Big num sub 1 failed, ret1=%d, ret2=%d\n", ret1, ret2);
578         ret1 = 0;
579         goto error;
580     }
581 
582     ret1 = BN_gcd(key_pair_bignum.bn_gcd, key_pair_bignum.bn_p, key_pair_bignum.bn_q, ctx);
583     ret2 = BN_div(key_pair_bignum.bn_p, key_pair_bignum.bn_div, key_pair_bignum.bn_p, key_pair_bignum.bn_gcd, ctx);
584     int32_t ret3 = BN_mul(key_pair_bignum.bn_div, key_pair_bignum.bn_q, key_pair_bignum.bn_p, ctx);
585     is_abnormal = (ret1 != 1) || (ret2 != 1) || (ret3 != 1);
586     if (is_abnormal) {
587         tloge("compute e and d failed, ret1=%d, ret2=%d, ret3=%d\n", ret1, ret2, ret3);
588         ret1 = 0;
589         goto error;
590     }
591     /* Big num tmp4 is not new allocated, can not be free */
592     BIGNUM *tmp4 = BN_mod_inverse(*bn_d, *bn_e, key_pair_bignum.bn_q, ctx);
593     if (tmp4 == NULL) {
594         tloge("Get big num d by mod inverse failed\n");
595         ret1 = 0;
596         goto error;
597     }
598 
599     ret1 = 1;
600 error:
601     BN_clear_free(key_pair_bignum.bn_p);
602     BN_clear_free(key_pair_bignum.bn_q);
603     BN_free(key_pair_bignum.bn_div);
604     BN_free(key_pair_bignum.bn_gcd);
605     return ret1;
606 }
607 
get_rsa_ned_big_num(BIGNUM * bn_p,BIGNUM * bn_q,BIGNUM ** bn_n,BIGNUM ** bn_e,BIGNUM ** bn_d)608 static int32_t get_rsa_ned_big_num(BIGNUM *bn_p, BIGNUM *bn_q, BIGNUM **bn_n, BIGNUM **bn_e, BIGNUM **bn_d)
609 {
610     BN_CTX *ctx = BN_CTX_new();
611     if (ctx == NULL) {
612         tloge("New bn ctx failed\n");
613         return 0;
614     }
615 
616     int32_t ret = BN_mul(*bn_n, bn_p, bn_q, ctx);
617     if (ret != 1) {
618         tloge("Big num mul failed\n");
619         BN_CTX_free(ctx);
620         return 0;
621     }
622 
623     ret = compute_rsa_ed_big_num(bn_p, bn_q, ctx, bn_e, bn_d);
624     BN_CTX_free(ctx);
625     if (ret != 1) {
626         tloge("Big num e and d compute failed\n");
627         return 0;
628     }
629 
630     return 1;
631 }
632 
check_private_key_len(const struct rsa_priv_key_t * private_key)633 static bool check_private_key_len(const struct rsa_priv_key_t *private_key)
634 {
635     if (private_key->e_len > RSA_EXPONENT_LEN ||
636         private_key->n_len > RSA_MAX_KEY_SIZE ||
637         private_key->d_len > RSA_MAX_KEY_SIZE ||
638         private_key->p_len > RSA_MAX_KEY_SIZE_CRT ||
639         private_key->q_len > RSA_MAX_KEY_SIZE_CRT ||
640         private_key->dp_len > RSA_MAX_KEY_SIZE_CRT ||
641         private_key->dq_len > RSA_MAX_KEY_SIZE_CRT ||
642         private_key->qinv_len > RSA_MAX_KEY_SIZE_CRT)
643         return false;
644     return true;
645 }
646 
convert_rsa_crt_to_boring(const struct rsa_priv_key_t * private_key)647 static RSA *convert_rsa_crt_to_boring(const struct rsa_priv_key_t *private_key)
648 {
649     bool check = check_private_key_len(private_key);
650     if (!check)
651         return NULL;
652 
653     BIGNUM *bn_n = BN_new();
654     BIGNUM *bn_e = BN_bin2bn(private_key->e, private_key->e_len, NULL);
655     BIGNUM *bn_d = BN_new();
656     BIGNUM *bn_array[RSA_CRT_KEY_ATTRIBUTE_COUNT] = { 0 };
657     bool is_abnormal = (bn_n == NULL) || (bn_e == NULL) || (bn_d == NULL);
658     if (is_abnormal) {
659         tloge("New big num n or e or d failed\n");
660         goto error;
661     }
662 
663     int32_t ret = get_rsa_crt_big_num(private_key, bn_array, RSA_CRT_KEY_ATTRIBUTE_COUNT);
664     if (ret != CRYPTO_SUCCESS) {
665         tloge("Change crt buffer num to big num failed, ret=0x%x\n", ret);
666         goto error;
667     }
668 
669     ret = get_rsa_ned_big_num(bn_array[0], bn_array[1], &bn_n, &bn_e, &bn_d);
670     if (ret != BORINGSSL_OK) {
671         tloge("Get big num n, e, d failed\n");
672         goto error;
673     }
674 
675     RSA *rsa_key = set_boring_rsa_key(bn_n, bn_e, bn_d, bn_array);
676     if (rsa_key == NULL) {
677         tloge("Set boring rsa key failed\n");
678         goto error;
679     }
680 
681     return rsa_key;
682 
683 error:
684     BN_free(bn_n);
685     BN_free(bn_e);
686     BN_clear_free(bn_d);
687     for (int32_t i = 0; i < RSA_CRT_KEY_ATTRIBUTE_COUNT; i++)
688         BN_clear_free(bn_array[i]);
689     return NULL;
690 }
691 
create_rsa_decrypt_ctx(const struct create_rsa_crypt_ctx_t * rsa_decrypt_ctx,const struct asymmetric_params_t * params,const struct rsa_priv_key_t * private_key,EVP_PKEY * evp_key)692 static EVP_PKEY_CTX *create_rsa_decrypt_ctx(const struct create_rsa_crypt_ctx_t *rsa_decrypt_ctx,
693     const struct asymmetric_params_t *params, const struct rsa_priv_key_t *private_key, EVP_PKEY *evp_key)
694 {
695     RSA *rsa_key = NULL;
696     if (private_key->crt_mode)
697         rsa_key = convert_rsa_crt_to_boring(private_key);
698     else
699         rsa_key = convert_rsa_non_crt_to_boring(private_key);
700     if (rsa_key == NULL) {
701         tloge("Duplicate rsa priv key failed\n");
702         return NULL;
703     }
704     int32_t rc = EVP_PKEY_assign_RSA(evp_key, rsa_key);
705     if (rc != 1) {
706         tloge("Evp assign rsa key failed\n");
707         RSA_free(rsa_key);
708         return NULL;
709     }
710     EVP_PKEY_CTX *ctx = generate_and_init_evp_rsa_ctx((rsa_decrypt_ctx->alg_type), params, (rsa_decrypt_ctx->mode),
711         (rsa_decrypt_ctx->padding), evp_key);
712     if (ctx == NULL) {
713         tloge("Create and init rsa evp ctx failed\n");
714         RSA_free(rsa_key);
715         return NULL;
716     }
717 
718     return ctx;
719 }
720 
721 #define SOFT_RSA_PKCS1_PADDING_LEN 11
check_pkcs1_padding(uint32_t dest_len,uint32_t key_size)722 static int32_t check_pkcs1_padding(uint32_t dest_len, uint32_t key_size)
723 {
724     if (key_size < SOFT_RSA_PKCS1_PADDING_LEN) {
725         tloge("Key size is invalid\n");
726         return CRYPTO_BAD_PARAMETERS;
727     }
728     if (dest_len < (key_size - SOFT_RSA_PKCS1_PADDING_LEN)) {
729         tloge("Dest len is too short, dest_len = 0x%x, max_src_len = 0x%x\n", dest_len,
730             (key_size - SOFT_RSA_PKCS1_PADDING_LEN));
731         return CRYPTO_SHORT_BUFFER;
732     }
733 
734     return CRYPTO_SUCCESS;
735 }
check_oaep_padding(uint32_t dest_len,uint32_t key_size,uint32_t hash_len)736 static int32_t check_oaep_padding(uint32_t dest_len, uint32_t key_size, uint32_t hash_len)
737 {
738     if (key_size < (SOFT_NUMBER_TWO * hash_len - SOFT_NUMBER_TWO)) {
739         tloge("Key size is invalid\n");
740         return CRYPTO_BAD_PARAMETERS;
741     }
742     if (dest_len < (key_size - SOFT_NUMBER_TWO * hash_len - SOFT_NUMBER_TWO)) {
743         tloge("Dest len is too short, dest_len = 0x%x, max_src_len = 0x%x\n", dest_len,
744             (key_size - (SOFT_NUMBER_TWO * hash_len - SOFT_NUMBER_TWO)));
745         return CRYPTO_SHORT_BUFFER;
746     }
747 
748     return CRYPTO_SUCCESS;
749 }
check_no_padding(uint32_t dest_len,uint32_t key_size)750 static int32_t check_no_padding(uint32_t dest_len, uint32_t key_size)
751 {
752     if (dest_len < key_size) {
753         tloge("Dest len is too short\n");
754         return CRYPTO_SHORT_BUFFER;
755     }
756 
757     return CRYPTO_SUCCESS;
758 }
759 
check_rsa_decrypt_destlen(uint32_t dest_len,int32_t padding,uint32_t key_size,uint32_t hash_len)760 static int32_t check_rsa_decrypt_destlen(uint32_t dest_len, int32_t padding, uint32_t key_size, uint32_t hash_len)
761 {
762     switch (padding) {
763     case RSA_PKCS1_PADDING:
764         return check_pkcs1_padding(dest_len, key_size);
765     case RSA_PKCS1_OAEP_PADDING:
766         return check_oaep_padding(dest_len, key_size, hash_len);
767     case RSA_NO_PADDING:
768         return check_no_padding(dest_len, key_size);
769     default:
770         return CRYPTO_BAD_PARAMETERS;
771     }
772 }
773 
check_is_rsa_pss_sign_algorithm(uint32_t algorithm)774 static bool check_is_rsa_pss_sign_algorithm(uint32_t algorithm)
775 {
776     size_t i = 0;
777     uint32_t algorithm_set[] = {
778         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_MD5,
779         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA1,
780         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA224,
781         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA256,
782         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA384,
783         CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA512
784     };
785     size_t total_set_num = sizeof(algorithm_set) / sizeof(uint32_t);
786     for (; i < total_set_num; i++) {
787         if (algorithm_set[i] == algorithm)
788             return true;
789     }
790 
791     return false;
792 }
793 
get_pss_salt_len_from_algorithm(uint32_t algorithm)794 static uint32_t get_pss_salt_len_from_algorithm(uint32_t algorithm)
795 {
796     size_t i = 0;
797     crypto_uint2uint algorithm_to_salt_len[] = {
798         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_MD5,    MD5_OUTPUT_LEN },
799         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA1,   SHA1_OUTPUT_LEN },
800         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA224, SHA224_OUTPUT_LEN },
801         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA256, SHA256_OUTPUT_LEN },
802         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA384, SHA384_OUTPUT_LEN },
803         { CRYPTO_TYPE_RSASSA_PKCS1_PSS_MGF1_SHA512, SHA512_OUTPUT_LEN }
804     };
805     size_t total_map_num = sizeof(algorithm_to_salt_len) / sizeof(crypto_uint2uint);
806     for (; i < total_map_num; i++) {
807         if (algorithm_to_salt_len[i].src == algorithm)
808             return algorithm_to_salt_len[i].dest;
809     }
810 
811     return 0;
812 }
813 
get_pss_salt_len(const struct asymmetric_params_t * rsa_params,uint32_t algorithm)814 static uint32_t get_pss_salt_len(const struct asymmetric_params_t *rsa_params, uint32_t algorithm)
815 {
816     if (rsa_params != NULL) {
817         struct crypto_attribute_t *attribute = (struct crypto_attribute_t *)(uintptr_t)(rsa_params->attribute);
818         if (attribute == NULL)
819             return 0;
820         int32_t index = get_attr_index_by_id(TEE_ATTR_RSA_PSS_SALT_LENGTH,
821             (const TEE_Attribute *)attribute, rsa_params->param_count);
822         if (index >= 0)
823             return attribute[index].content.value.a;
824     }
825 
826     return get_pss_salt_len_from_algorithm(algorithm);
827 }
828 
do_rsa_sign_pss(RSA * rsa_key,const EVP_MD * md,const struct memref_t * digest,struct memref_t * signature,uint32_t salt_len)829 static int32_t do_rsa_sign_pss(RSA *rsa_key, const EVP_MD *md,
830     const struct memref_t *digest, struct memref_t *signature, uint32_t salt_len)
831 {
832     uint32_t em_len = (uint32_t)RSA_size(rsa_key);
833     if (em_len > MAX_SOFT_ASYMMETRIC_KEY_SIZE) {
834         tloge("key size is Invalid");
835         return CRYPTO_BAD_PARAMETERS;
836     }
837 
838     uint8_t *em_buf = TEE_Malloc(em_len, 0);
839     if (em_buf == NULL) {
840         tloge("Malloc em buf failed, em_len=%u\n", em_len);
841         return CRYPTO_ERROR_OUT_OF_MEMORY;
842     }
843     int rc = RSA_padding_add_PKCS1_PSS_mgf1(rsa_key, em_buf, (uint8_t *)(uintptr_t)(digest->buffer), md, md, salt_len);
844     if (rc != OPENSSL_OK) {
845         tloge("Rsa padding add pss mgf1 failed, rc=%d\n", rc);
846         TEE_Free(em_buf);
847         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
848     }
849     int out_len = RSA_private_encrypt(em_len, em_buf, (uint8_t *)(uintptr_t)(signature->buffer),
850         rsa_key, RSA_NO_PADDING);
851     TEE_Free(em_buf);
852     em_buf = NULL;
853     if (out_len < 0) {
854         tloge("Rsa pss sign failed, rc=%d\n", out_len);
855         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
856     }
857     signature->size = (uint32_t)out_len;
858     return CRYPTO_SUCCESS;
859 }
860 
soft_rsa_pss_sign_digest(uint32_t alg_type,const struct asymmetric_params_t * rsa_params,const struct rsa_priv_key_t * private_key,const struct memref_t * digest,struct memref_t * signature)861 static int32_t soft_rsa_pss_sign_digest(uint32_t alg_type, const struct asymmetric_params_t *rsa_params,
862     const struct rsa_priv_key_t *private_key, const struct memref_t *digest, struct memref_t *signature)
863 {
864     int hash_nid = NID_sha1;
865     RSA *rsa_key = NULL;
866     if (private_key->crt_mode)
867         rsa_key = convert_rsa_crt_to_boring(private_key);
868     else
869         rsa_key = convert_rsa_non_crt_to_boring(private_key);
870     if (rsa_key == NULL) {
871         tloge("Duplicate rsa priv key failed\n");
872         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
873     }
874 
875     int32_t ret = get_hash_nid_from_algorithm(alg_type, &hash_nid);
876     if (ret != CRYPTO_SUCCESS) {
877         tloge("Get hash nid from algorithm failed\n");
878         RSA_free(rsa_key);
879         return ret;
880     }
881 
882     const EVP_MD *md = EVP_get_digestbynid(hash_nid);
883     if (md == NULL) {
884         tloge("Get evp digest by nid failed, hash_nid=%d\n", hash_nid);
885         RSA_free(rsa_key);
886         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
887     }
888 
889     uint32_t salt_len = get_pss_salt_len(rsa_params, alg_type);
890     if (salt_len == 0) {
891         RSA_free(rsa_key);
892         return CRYPTO_BAD_PARAMETERS;
893     }
894     ret = do_rsa_sign_pss(rsa_key, md, digest, signature, salt_len);
895     RSA_free(rsa_key);
896     return ret;
897 }
898 
get_rsa_key(const struct rsa_priv_key_t * private_key)899 static RSA *get_rsa_key(const struct rsa_priv_key_t *private_key)
900 {
901     if (private_key->crt_mode)
902         return convert_rsa_crt_to_boring(private_key);
903 
904     return convert_rsa_non_crt_to_boring(private_key);
905 }
906 
soft_rsa_non_pss_sign_digest(uint32_t alg_type,const struct rsa_priv_key_t * private_key,const struct memref_t * digest,struct memref_t * signature)907 static int32_t soft_rsa_non_pss_sign_digest(uint32_t alg_type,
908     const struct rsa_priv_key_t *private_key, const struct memref_t *digest, struct memref_t *signature)
909 {
910     int32_t hash_nid = NID_sha1;
911     RSA *rsa_key = get_rsa_key(private_key);
912     if (rsa_key == NULL) {
913         tloge("Duplicate rsa priv key failed\n");
914         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
915     }
916 
917     int32_t ret = get_hash_nid_from_algorithm(alg_type, &hash_nid);
918     if (ret != CRYPTO_SUCCESS) {
919         tloge("Get hash nid from operation algorithm failed\n");
920         RSA_free(rsa_key);
921         return ret;
922     }
923 
924     uint8_t *digest_buffer = (uint8_t *)(uintptr_t)(digest->buffer);
925     uint8_t *signature_buffer = (uint8_t *)(uintptr_t)(signature->buffer);
926 
927     uint32_t signature_len_temp = signature->size;
928     int rc = RSA_sign(hash_nid, digest_buffer, digest->size, signature_buffer, &signature_len_temp, rsa_key);
929     RSA_free(rsa_key);
930     if (rc != BORINGSSL_OK) {
931         tloge("Soft rsa non pss sign digest failed\n");
932         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
933     }
934 
935     signature->size = signature_len_temp;
936     return CRYPTO_SUCCESS;
937 }
938 
soft_rsa_non_pss_verify_digest(uint32_t alg_type,const struct rsa_pub_key_t * public_key,const struct memref_t * digest,const struct memref_t * signature)939 static int32_t soft_rsa_non_pss_verify_digest(uint32_t alg_type, const struct rsa_pub_key_t *public_key,
940     const struct memref_t *digest, const struct memref_t *signature)
941 {
942     int hash_nid = NID_sha1;
943     RSA *rsa_key = convert_rsa_pub_to_boring(public_key);
944     if (rsa_key == NULL) {
945         tloge("Duplicate rsa priv key failed\n");
946         return CRYPTO_BAD_PARAMETERS;
947     }
948 
949     int32_t ret = get_hash_nid_from_algorithm(alg_type, &hash_nid);
950     if (ret != CRYPTO_SUCCESS) {
951         tloge("Get hash nid from algorithm failed\n");
952         RSA_free(rsa_key);
953         return ret;
954     }
955     uint8_t *digest_buffer = (uint8_t *)(uintptr_t)(digest->buffer);
956     uint8_t *signature_buffer = (uint8_t *)(uintptr_t)(signature->buffer);
957 
958     ret = RSA_verify(hash_nid, digest_buffer, digest->size, signature_buffer,
959         signature->size, rsa_key);
960     RSA_free(rsa_key);
961     if (ret != BORINGSSL_OK) {
962         tloge("Soft rsa verify digest failed\n");
963         return get_soft_crypto_error(CRYPTO_SIGNATURE_INVALID);
964     }
965 
966     return CRYPTO_SUCCESS;
967 }
968 
do_rsa_verify_pss(RSA * rsa_key,const EVP_MD * md,const struct memref_t * digest,const struct memref_t * signature,uint32_t salt_len)969 static int32_t do_rsa_verify_pss(RSA *rsa_key, const EVP_MD *md,
970     const struct memref_t *digest, const struct memref_t *signature, uint32_t salt_len)
971 {
972     uint8_t *digest_buffer = (uint8_t *)(uintptr_t)(digest->buffer);
973     uint8_t *signature_buffer = (uint8_t *)(uintptr_t)(signature->buffer);
974 
975     uint32_t em_len = (uint32_t)RSA_size(rsa_key);
976     if (em_len > MAX_SOFT_ASYMMETRIC_KEY_SIZE) {
977         tloge("keysize is Invalid");
978         return CRYPTO_BAD_PARAMETERS;
979     }
980     uint8_t *em_buf = TEE_Malloc(em_len, 0);
981     if (em_buf == NULL) {
982         tloge("Malloc em buf failed, em_len=%u\n", em_len);
983         return CRYPTO_ERROR_OUT_OF_MEMORY;
984     }
985     int rc = RSA_public_decrypt(signature->size, signature_buffer, em_buf, rsa_key, RSA_NO_PADDING);
986     if (rc <= BORINGSSL_ERR) {
987         tloge("Rsa public decrypt failed, rc=%d\n", rc);
988         TEE_Free(em_buf);
989         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
990     }
991     rc = RSA_verify_PKCS1_PSS_mgf1(rsa_key, digest_buffer, md, md, em_buf, (int)salt_len);
992     TEE_Free(em_buf);
993     em_buf = NULL;
994     if (rc != BORINGSSL_OK) {
995         tloge("Rsa pss verify failed, rc=%d\n", rc);
996         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
997     }
998     return CRYPTO_SUCCESS;
999 }
1000 
soft_rsa_pss_verify_digest(uint32_t alg_type,const struct asymmetric_params_t * rsa_params,const struct rsa_pub_key_t * public_key,const struct memref_t * digest,const struct memref_t * signature)1001 static int32_t soft_rsa_pss_verify_digest(uint32_t alg_type, const struct asymmetric_params_t *rsa_params,
1002     const struct rsa_pub_key_t *public_key, const struct memref_t *digest, const struct memref_t *signature)
1003 {
1004     int hash_nid = NID_sha1;
1005     RSA *rsa_key = convert_rsa_pub_to_boring(public_key);
1006     if (rsa_key == NULL) {
1007         tloge("Duplicate rsa priv key failed\n");
1008         return CRYPTO_BAD_PARAMETERS;
1009     }
1010 
1011     int32_t ret = get_hash_nid_from_algorithm(alg_type, &hash_nid);
1012     if (ret != CRYPTO_SUCCESS) {
1013         tloge("Get hash nid from operation algorithm failed\n");
1014         RSA_free(rsa_key);
1015         return ret;
1016     }
1017 
1018     const EVP_MD *md = EVP_get_digestbynid(hash_nid);
1019     if (md == NULL) {
1020         tloge("Get digest by nid failed, hash_nid=%d\n", hash_nid);
1021         RSA_free(rsa_key);
1022         return get_soft_crypto_error(TEE_ERROR_GENERIC);
1023     }
1024 
1025     uint32_t salt_len = get_pss_salt_len(rsa_params, alg_type);
1026     ret = do_rsa_verify_pss(rsa_key, md, digest, signature, salt_len);
1027     RSA_free(rsa_key);
1028     return ret;
1029 }
1030 
soft_crypto_rsa_generate_keypair(uint32_t key_size,const struct memref_t * e_value,bool crt_mode,struct rsa_priv_key_t * key_pair)1031 int32_t soft_crypto_rsa_generate_keypair(uint32_t key_size, const struct memref_t *e_value, bool crt_mode,
1032     struct rsa_priv_key_t *key_pair)
1033 {
1034     if (e_value == NULL || key_pair == NULL) {
1035         tloge("bad parameters");
1036         return CRYPTO_BAD_PARAMETERS;
1037     }
1038     uint32_t exponent = 0;
1039     uint8_to_uint32((uint8_t *)(uintptr_t)(e_value->buffer), e_value->size, &exponent);
1040     if (exponent > 0xffffff) /* find wrong exponent */
1041         return CRYPTO_NOT_SUPPORTED;
1042     return soft_gen_rsa_key_pair(key_size, exponent, crt_mode, key_pair);
1043 }
1044 
do_rsa_encrypt(struct create_rsa_crypt_ctx_t * rsa_encrypt_ctx,const struct asymmetric_params_t * rsa_params,const struct rsa_pub_key_t * public_key,const struct memref_t * data_in,struct memref_t * data_out)1045 static int32_t do_rsa_encrypt(struct create_rsa_crypt_ctx_t *rsa_encrypt_ctx,
1046     const struct asymmetric_params_t *rsa_params, const struct rsa_pub_key_t *public_key,
1047     const struct memref_t *data_in, struct memref_t *data_out)
1048 {
1049     EVP_PKEY *evp_key = EVP_PKEY_new();
1050     if (evp_key == NULL) {
1051         tloge("Create rsa evp key failed\n");
1052         return get_soft_crypto_error(CRYPTO_ERROR_OUT_OF_MEMORY);
1053     }
1054 
1055     EVP_PKEY_CTX *ctx = create_rsa_encrypt_ctx(rsa_encrypt_ctx, rsa_params, public_key, evp_key);
1056     if (ctx == NULL) {
1057         tloge("Create rsa encrypt ctx failed\n");
1058         EVP_PKEY_free(evp_key); /* rsa_key will free together with evp_key, can not free it alone */
1059         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
1060     }
1061 
1062     size_t data_out_size = data_out->size;
1063     int32_t ret = EVP_PKEY_encrypt(ctx, (uint8_t *)(uintptr_t)data_out->buffer, &data_out_size,
1064         (uint8_t *)(uintptr_t)data_in->buffer, data_in->size);
1065     EVP_PKEY_free(evp_key); /* rsa_key will free together with evp_key, can not free it alone */
1066     EVP_PKEY_CTX_free(ctx);
1067     if (ret != BORINGSSL_OK || data_out_size > UINT32_MAX) {
1068         tloge("Evp rsa encrypt failed\n");
1069         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
1070     }
1071     data_out->size = (uint32_t)data_out_size;
1072     return CRYPTO_SUCCESS;
1073 }
1074 
soft_crypto_rsa_encrypt(uint32_t alg_type,const struct rsa_pub_key_t * public_key,const struct asymmetric_params_t * rsa_params,const struct memref_t * data_in,struct memref_t * data_out)1075 int32_t soft_crypto_rsa_encrypt(uint32_t alg_type, const struct rsa_pub_key_t *public_key,
1076     const struct asymmetric_params_t *rsa_params, const struct memref_t *data_in, struct memref_t *data_out)
1077 {
1078     bool check = (public_key == NULL || data_in == NULL || data_out == NULL || data_in->buffer == 0 ||
1079         data_out->buffer == 0 || (check_params(rsa_params) != TEE_SUCCESS));
1080     if (check) {
1081         tloge("bad params");
1082         return CRYPTO_BAD_PARAMETERS;
1083     }
1084 
1085     struct create_rsa_crypt_ctx_t rsa_encrypt_ctx = {0};
1086     int32_t padding = RSA_PKCS1_PADDING;
1087     uint32_t hash_len = 0;
1088     int32_t ret = convert_rsa_padding_to_boring(alg_type, &padding, &hash_len);
1089     if (ret != CRYPTO_SUCCESS) {
1090         tloge("Convert rsa padding to boring failed\n");
1091         return ret;
1092     }
1093 
1094     rsa_encrypt_ctx.alg_type = alg_type;
1095     rsa_encrypt_ctx.mode = ENC_MODE;
1096     rsa_encrypt_ctx.padding = padding;
1097 
1098     return do_rsa_encrypt(&rsa_encrypt_ctx, rsa_params, public_key, data_in, data_out);
1099 }
1100 
do_rsa_decrypt(struct create_rsa_crypt_ctx_t * rsa_decrypt_ctx,const struct asymmetric_params_t * rsa_params,const struct rsa_priv_key_t * private_key,const struct memref_t * data_in,struct memref_t * data_out)1101 static int32_t do_rsa_decrypt(struct create_rsa_crypt_ctx_t *rsa_decrypt_ctx,
1102     const struct asymmetric_params_t *rsa_params, const struct rsa_priv_key_t *private_key,
1103     const struct memref_t *data_in, struct memref_t *data_out)
1104 {
1105     EVP_PKEY *evp_key = EVP_PKEY_new();
1106     if (evp_key == NULL) {
1107         tloge("Create rsa evp key failed\n");
1108         return get_soft_crypto_error(CRYPTO_ERROR_OUT_OF_MEMORY);
1109     }
1110 
1111     EVP_PKEY_CTX *ctx = create_rsa_decrypt_ctx(rsa_decrypt_ctx, rsa_params, private_key, evp_key);
1112     if (ctx == NULL) {
1113         tloge("Create rsa decrypt ctx failed\n");
1114         EVP_PKEY_free(evp_key); /* rsa_key will free together with evp_key, can not free it alone */
1115         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
1116     }
1117 
1118     size_t data_out_size = data_in->size;
1119     int32_t ret = EVP_PKEY_decrypt(ctx, (uint8_t *)(uintptr_t)data_out->buffer, &data_out_size,
1120         (uint8_t *)(uintptr_t)data_in->buffer, data_in->size);
1121     EVP_PKEY_free(evp_key); /* rsa_key will free together with evp_key, can not free it alone */
1122     EVP_PKEY_CTX_free(ctx);
1123     if (ret != BORINGSSL_OK || data_out_size > UINT32_MAX) {
1124         tloge("Evp rsa decrypt failed, ret:%d\n", ret);
1125         return get_soft_crypto_error(CRYPTO_BAD_PARAMETERS);
1126     }
1127 
1128     data_out->size = (uint32_t)data_out_size;
1129     return CRYPTO_SUCCESS;
1130 }
1131 
soft_crypto_rsa_decrypt(uint32_t alg_type,const struct rsa_priv_key_t * private_key,const struct asymmetric_params_t * rsa_params,const struct memref_t * data_in,struct memref_t * data_out)1132 int32_t soft_crypto_rsa_decrypt(uint32_t alg_type, const struct rsa_priv_key_t *private_key,
1133     const struct asymmetric_params_t *rsa_params, const struct memref_t *data_in, struct memref_t *data_out)
1134 {
1135     bool check = (private_key == NULL || data_in == NULL || data_out == NULL || data_in->buffer == 0 ||
1136         data_out->buffer == 0 || (check_params(rsa_params) != TEE_SUCCESS));
1137     if (check) {
1138         tloge("bad params");
1139         return CRYPTO_BAD_PARAMETERS;
1140     }
1141 
1142     int32_t padding = RSA_PKCS1_PADDING;
1143     uint32_t hash_len = 0;
1144     int32_t ret  = convert_rsa_padding_to_boring(alg_type, &padding, &hash_len);
1145     if (ret != CRYPTO_SUCCESS) {
1146         tloge("Convert rsa padding to boring failed\n");
1147         return ret;
1148     }
1149 
1150     ret = check_rsa_decrypt_destlen(data_out->size, padding, private_key->n_len, hash_len);
1151     if (ret != CRYPTO_SUCCESS) {
1152         tloge("dest_len is invalid");
1153         return CRYPTO_SHORT_BUFFER;
1154     }
1155 
1156     struct create_rsa_crypt_ctx_t rsa_decrypt_ctx = {0};
1157     rsa_decrypt_ctx.alg_type = alg_type;
1158     rsa_decrypt_ctx.mode = DEC_MODE;
1159     rsa_decrypt_ctx.padding = padding;
1160 
1161     return do_rsa_decrypt(&rsa_decrypt_ctx, rsa_params, private_key, data_in, data_out);
1162 }
1163 
soft_crypto_rsa_sign_digest(uint32_t alg_type,const struct rsa_priv_key_t * private_key,const struct asymmetric_params_t * rsa_params,const struct memref_t * digest,struct memref_t * signature)1164 int32_t soft_crypto_rsa_sign_digest(uint32_t alg_type, const struct rsa_priv_key_t *private_key,
1165     const struct asymmetric_params_t *rsa_params, const struct memref_t *digest,
1166     struct memref_t *signature)
1167 {
1168     bool check = (private_key == NULL || digest == NULL || signature == NULL || digest->buffer == 0 ||
1169         signature->buffer == 0 || (check_params(rsa_params) != TEE_SUCCESS));
1170     if (check) {
1171         tloge("bad params");
1172         return CRYPTO_BAD_PARAMETERS;
1173     }
1174     bool is_pss_sign_algorithm = check_is_rsa_pss_sign_algorithm(alg_type);
1175     if (is_pss_sign_algorithm)
1176         return soft_rsa_pss_sign_digest(alg_type, rsa_params, private_key, digest, signature);
1177     else
1178         return soft_rsa_non_pss_sign_digest(alg_type, private_key, digest, signature);
1179 }
1180 
soft_crypto_rsa_verify_digest(uint32_t alg_type,const struct rsa_pub_key_t * public_key,const struct asymmetric_params_t * rsa_params,const struct memref_t * digest,const struct memref_t * signature)1181 int32_t soft_crypto_rsa_verify_digest(uint32_t alg_type, const struct rsa_pub_key_t *public_key,
1182     const struct asymmetric_params_t *rsa_params, const struct memref_t *digest,
1183     const struct memref_t *signature)
1184 {
1185     bool check = (public_key == NULL || digest == NULL || signature == NULL || digest->buffer == 0 ||
1186         signature->buffer == 0 || (check_params(rsa_params) != TEE_SUCCESS));
1187     if (check) {
1188         tloge("bad params");
1189         return CRYPTO_BAD_PARAMETERS;
1190     }
1191 
1192     bool is_pss_verify_algorithm = check_is_rsa_pss_sign_algorithm(alg_type);
1193     if (is_pss_verify_algorithm)
1194         return soft_rsa_pss_verify_digest(alg_type, rsa_params, public_key, digest, signature);
1195     else
1196         return soft_rsa_non_pss_verify_digest(alg_type, public_key, digest, signature);
1197 }
1198