Skip to content

Commit 3649de2

Browse files
uenoueno
committed
Stop using RSA_* functions for signatures
For creating and verifying PKCS#1 v1.5 signatures in a pre-hashed manner, we used the legacy RSA_sign and RSA_verify functions, which bypass the system-wide disablement of SHA-1 and shorter RSA key length usage inconsistently with the OpenSSL 3.0 default on RHEL. This switches to using our _goboringcrypto_EVP_{sign,verify}_raw, which internally use EVP_PKEY_ functions. Signed-off-by: Daiki Ueno <[email protected]>
1 parent 5e3abca commit 3649de2

File tree

6 files changed

+244
-109
lines changed

6 files changed

+244
-109
lines changed

‎openssl/goopenssl.h‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -553,15 +553,9 @@ DEFINEFUNC(int, EVP_DigestVerifyFinal,
553553
(ctx, sig, siglen))
554554

555555
typedef RSA GO_RSA;
556-
int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *eckey);
557-
int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
558-
size_t msgLen, uint8_t *sig, size_t *slen,
559-
GO_RSA *key);
560556

557+
int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *eckey);
561558
int _goboringcrypto_EVP_verify(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, const uint8_t *sig, unsigned int slen, EVP_PKEY *key);
562-
int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
563-
const uint8_t *sig, unsigned int slen,
564-
GO_RSA *key);
565559

566560
#if OPENSSL_VERSION_NUMBER < 0x10100000L
567561
DEFINEFUNCINTERNAL(void, EVP_MD_CTX_destroy, (EVP_MD_CTX *ctx), (ctx))
@@ -583,20 +577,15 @@ typedef BN_GENCB GO_BN_GENCB;
583577
int _goboringcrypto_EVP_RSA_sign(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, size_t *slen, RSA *rsa);
584578
int _goboringcrypto_EVP_RSA_verify(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, const uint8_t *sig, unsigned int slen, GO_RSA *rsa);
585579

580+
int _goboringcrypto_EVP_RSA_sign_raw(EVP_MD *md, const uint8_t *msg, size_t msgLen,
581+
uint8_t *sig, size_t *slen,
582+
GO_RSA *key);
583+
int _goboringcrypto_EVP_RSA_verify_raw(EVP_MD *md, const uint8_t *msg, size_t msgLen,
584+
const uint8_t *sig, unsigned int slen,
585+
GO_RSA *key);
586+
586587
DEFINEFUNC(GO_RSA *, RSA_new, (void), ())
587588
DEFINEFUNC(void, RSA_free, (GO_RSA * arg0), (arg0))
588-
DEFINEFUNC(int, RSA_private_encrypt,
589-
(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding),
590-
(flen, from, to, rsa, padding))
591-
DEFINEFUNC(int, RSA_public_decrypt,
592-
(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding),
593-
(flen, from, to, rsa, padding))
594-
DEFINEFUNC(int, RSA_sign,
595-
(int arg0, const uint8_t *arg1, unsigned int arg2, uint8_t *arg3, unsigned int *arg4, GO_RSA *arg5),
596-
(arg0, arg1, arg2, arg3, arg4, arg5))
597-
DEFINEFUNC(int, RSA_verify,
598-
(int arg0, const uint8_t *arg1, unsigned int arg2, const uint8_t *arg3, unsigned int arg4, GO_RSA *arg5),
599-
(arg0, arg1, arg2, arg3, arg4, arg5))
600589
DEFINEFUNC(int, RSA_generate_key_ex,
601590
(GO_RSA * arg0, int arg1, GO_BIGNUM *arg2, GO_BN_GENCB *arg3),
602591
(arg0, arg1, arg2, arg3))

‎openssl/notboring.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func VerifyECDSA(pub *PublicKeyECDSA, hash []byte, r, s BigInt, h crypto.Hash) b
7171
type PublicKeyECDH struct{ _ int }
7272
type PrivateKeyECDH struct{ _ int }
7373

74-
func (pc *PublicKeyECDH) Bytes() []byte { panic("boringcrypto: not available") }
74+
func (pc *PublicKeyECDH) Bytes() []byte { panic("boringcrypto: not available") }
7575
func (pc *PrivateKeyECDH) PublicKey() (*PublicKeyECDH, error) { panic("boringcrypto: not available") }
7676

7777
func NewPublicKeyECDH(curve string, bytes []byte) (*PublicKeyECDH, error) {

‎openssl/openssl_evp.c‎

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -38,35 +38,6 @@ int _goboringcrypto_EVP_sign(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
3838
return ret;
3939
}
4040

41-
int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
42-
size_t msgLen, uint8_t *sig, size_t *slen,
43-
GO_RSA *rsa_key) {
44-
int ret = 0;
45-
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
46-
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
47-
48-
if (!ctx && !(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
49-
goto err;
50-
51-
if (1 != _goboringcrypto_EVP_PKEY_sign_init(ctx))
52-
goto err;
53-
54-
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
55-
goto err;
56-
57-
if (1 != _goboringcrypto_EVP_PKEY_sign(ctx, sig, slen, msg, msgLen))
58-
goto err;
59-
60-
/* Success */
61-
ret = 1;
62-
63-
err:
64-
if (ctx)
65-
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
66-
67-
return ret;
68-
}
69-
7041
int _goboringcrypto_EVP_verify(EVP_MD *md, EVP_PKEY_CTX *ctx,
7142
const uint8_t *msg, size_t msgLen,
7243
const uint8_t *sig, unsigned int slen,
@@ -95,34 +66,3 @@ int _goboringcrypto_EVP_verify(EVP_MD *md, EVP_PKEY_CTX *ctx,
9566

9667
return ret;
9768
}
98-
99-
int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
100-
const uint8_t *sig, unsigned int slen,
101-
GO_RSA *rsa_key) {
102-
103-
int ret = 0;
104-
EVP_PKEY_CTX *ctx;
105-
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
106-
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
107-
108-
if (!(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
109-
goto err;
110-
111-
if (1 != _goboringcrypto_EVP_PKEY_verify_init(ctx))
112-
goto err;
113-
114-
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
115-
goto err;
116-
117-
if (1 != _goboringcrypto_EVP_PKEY_verify(ctx, sig, slen, msg, msgLen))
118-
goto err;
119-
120-
/* Success */
121-
ret = 1;
122-
123-
err:
124-
if (ctx)
125-
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
126-
127-
return ret;
128-
}

‎openssl/openssl_port_rsa.c‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,3 +217,82 @@ int _goboringcrypto_EVP_RSA_verify(EVP_MD *md, const uint8_t *msg,
217217
_goboringcrypto_EVP_PKEY_free(key);
218218
return result;
219219
}
220+
221+
int _goboringcrypto_EVP_RSA_sign_raw(EVP_MD *md, const uint8_t *msg,
222+
size_t msgLen, uint8_t *sig, size_t *slen,
223+
GO_RSA *rsa_key) {
224+
int ret = 0;
225+
GO_EVP_PKEY_CTX *ctx = NULL;
226+
GO_EVP_PKEY *pk = NULL;
227+
228+
pk = _goboringcrypto_EVP_PKEY_new();
229+
if (!pk)
230+
goto err;
231+
232+
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
233+
234+
ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL);
235+
if (!ctx)
236+
goto err;
237+
238+
if (1 != _goboringcrypto_EVP_PKEY_sign_init(ctx))
239+
goto err;
240+
241+
if (md && 1 != _goboringcrypto_EVP_PKEY_CTX_set_signature_md(ctx, md))
242+
goto err;
243+
244+
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
245+
goto err;
246+
247+
if (1 != _goboringcrypto_EVP_PKEY_sign(ctx, sig, slen, msg, msgLen))
248+
goto err;
249+
250+
/* Success */
251+
ret = 1;
252+
253+
err:
254+
if (ctx)
255+
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
256+
257+
return ret;
258+
}
259+
260+
int _goboringcrypto_EVP_RSA_verify_raw(EVP_MD *md,
261+
const uint8_t *msg, size_t msgLen,
262+
const uint8_t *sig, unsigned int slen,
263+
GO_RSA *rsa_key) {
264+
int ret = 0;
265+
GO_EVP_PKEY_CTX *ctx = NULL;
266+
GO_EVP_PKEY *pk = NULL;
267+
268+
pk = _goboringcrypto_EVP_PKEY_new();
269+
if (!pk)
270+
goto err;
271+
272+
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
273+
274+
ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL);
275+
if (!ctx)
276+
goto err;
277+
278+
if (1 != _goboringcrypto_EVP_PKEY_verify_init(ctx))
279+
goto err;
280+
281+
if (md && 1 != _goboringcrypto_EVP_PKEY_CTX_set_signature_md(ctx, md))
282+
goto err;
283+
284+
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
285+
goto err;
286+
287+
if (1 != _goboringcrypto_EVP_PKEY_verify(ctx, sig, slen, msg, msgLen))
288+
goto err;
289+
290+
/* Success */
291+
ret = 1;
292+
293+
err:
294+
if (ctx)
295+
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
296+
297+
return ret;
298+
}

‎openssl/rsa.go‎

Lines changed: 15 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen
302302

303303
func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed bool) ([]byte, error) {
304304
if h == 0 && ExecutingTest() {
305-
return signRSAPKCS1v15Raw(priv, msg, C._goboringcrypto_EVP_md_null())
305+
return signRSAPKCS1v15Raw(priv, msg, nil)
306306
}
307307

308308
md := cryptoHashToMD(h)
@@ -311,24 +311,15 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed
311311
}
312312

313313
if msgIsHashed {
314-
var out []byte
315-
var outLen C.uint
316-
PanicIfStrictFIPS("You must provide a raw unhashed message for PKCS1v15 signing and use HashSignPKCS1v15 instead of SignPKCS1v15")
317-
nid := C._goboringcrypto_EVP_MD_type(md)
318-
if priv.withKey(func(key *C.GO_RSA) C.int {
319-
out = make([]byte, C._goboringcrypto_RSA_size(key))
320-
return C._goboringcrypto_RSA_sign(nid, base(msg), C.uint(len(msg)), base(out), &outLen, key)
321-
}) == 0 {
322-
return nil, NewOpenSSLError("RSA_sign")
323-
}
324-
runtime.KeepAlive(priv)
325-
return out[:outLen], nil
314+
return signRSAPKCS1v15Raw(priv, msg, md)
326315
}
327316

328317
var out []byte
329318
var outLen C.size_t
330319

331320
if priv.withKey(func(key *C.GO_RSA) C.int {
321+
out = make([]byte, C._goboringcrypto_RSA_size(key))
322+
outLen = C.size_t(len(out))
332323
return C._goboringcrypto_EVP_RSA_sign(md, base(msg), C.uint(len(msg)), base(out), &outLen, key)
333324
}) == 0 {
334325
return nil, NewOpenSSLError("RSA_sign")
@@ -344,7 +335,7 @@ func signRSAPKCS1v15Raw(priv *PrivateKeyRSA, msg []byte, md *C.GO_EVP_MD) ([]byt
344335
if priv.withKey(func(key *C.GO_RSA) C.int {
345336
out = make([]byte, C._goboringcrypto_RSA_size(key))
346337
outLen = C.size_t(len(out))
347-
return C._goboringcrypto_EVP_sign_raw(md, nil, base(msg),
338+
return C._goboringcrypto_EVP_RSA_sign_raw(md, base(msg),
348339
C.size_t(len(msg)), base(out), &outLen, key)
349340
}) == 0 {
350341
return nil, NewOpenSSLError("RSA_sign")
@@ -355,14 +346,18 @@ func signRSAPKCS1v15Raw(priv *PrivateKeyRSA, msg []byte, md *C.GO_EVP_MD) ([]byt
355346

356347
func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsHashed bool) error {
357348
if h == 0 && ExecutingTest() {
358-
return verifyRSAPKCS1v15Raw(pub, msg, sig)
349+
return verifyRSAPKCS1v15Raw(pub, msg, sig, nil)
359350
}
360351

361352
md := cryptoHashToMD(h)
362353
if md == nil {
363354
return errors.New("crypto/rsa: unsupported hash function")
364355
}
365356

357+
if msgIsHashed {
358+
return verifyRSAPKCS1v15Raw(pub, msg, sig, md)
359+
}
360+
366361
if pub.withKey(func(key *C.GO_RSA) C.int {
367362
size := int(C._goboringcrypto_RSA_size(key))
368363
if len(sig) < size {
@@ -373,26 +368,16 @@ func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsH
373368
return errors.New("crypto/rsa: verification error")
374369
}
375370

376-
if msgIsHashed {
377-
PanicIfStrictFIPS("You must provide a raw unhashed message for PKCS1v15 verification and use HashVerifyPKCS1v15 instead of VerifyPKCS1v15")
378-
nid := C._goboringcrypto_EVP_MD_type(md)
379-
if pub.withKey(func(key *C.GO_RSA) C.int {
380-
return C._goboringcrypto_RSA_verify(nid, base(msg), C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
381-
}) == 0 {
382-
return NewOpenSSLError("RSA_verify failed")
383-
}
384-
return nil
385-
}
386-
387371
if pub.withKey(func(key *C.GO_RSA) C.int {
388-
return C._goboringcrypto_EVP_RSA_verify(md, base(msg), C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
372+
return C._goboringcrypto_EVP_RSA_verify(md, base(msg),
373+
C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
389374
}) == 0 {
390375
return NewOpenSSLError("RSA_verify failed")
391376
}
392377
return nil
393378
}
394379

395-
func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte) error {
380+
func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte, md *C.GO_EVP_MD) error {
396381
if pub.withKey(func(key *C.GO_RSA) C.int {
397382
size := int(C._goboringcrypto_RSA_size(key))
398383
if len(sig) < size {
@@ -403,7 +388,8 @@ func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte) error {
403388
return errors.New("crypto/rsa: verification error")
404389
}
405390
if pub.withKey(func(key *C.GO_RSA) C.int {
406-
return C._goboringcrypto_EVP_verify_raw(base(msg), C.size_t(len(msg)), base(sig), C.uint(len(sig)), key)
391+
return C._goboringcrypto_EVP_RSA_verify_raw(md, base(msg),
392+
C.size_t(len(msg)), base(sig), C.uint(len(sig)), key)
407393
}) == 0 {
408394
return NewOpenSSLError("RSA_verify failed")
409395
}

0 commit comments

Comments
 (0)