Skip to content

Commit d13c0e0

Browse files
uenoueno
committed
Stop using RSA_* functions for signatures
For creating and verifying PKCS#1 v1.5 signatures in a pre-hashed manner, we used the legacy RSA_sign and RSA_verify functions, which bypass the system-wide disablement of SHA-1 and shorter RSA key length usage inconsistently with the OpenSSL 3.0 default on RHEL. This switches to using our _goboringcrypto_EVP_{sign,verify}_raw, which internally use EVP_PKEY_ functions. Signed-off-by: Daiki Ueno <[email protected]>
1 parent e154188 commit d13c0e0

File tree

6 files changed

+255
-118
lines changed

6 files changed

+255
-118
lines changed

‎openssl/goopenssl.h

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -557,15 +557,9 @@ DEFINEFUNC(int, EVP_DigestVerifyFinal,
557557
(ctx, sig, siglen))
558558

559559
typedef RSA GO_RSA;
560-
int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *eckey);
561-
int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
562-
size_t msgLen, uint8_t *sig, size_t *slen,
563-
GO_RSA *key);
564560

561+
int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *eckey);
565562
int _goboringcrypto_EVP_verify(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, const uint8_t *sig, unsigned int slen, EVP_PKEY *key);
566-
int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
567-
const uint8_t *sig, unsigned int slen,
568-
GO_RSA *key);
569563

570564
#if OPENSSL_VERSION_NUMBER < 0x10100000L
571565
DEFINEFUNCINTERNAL(void, EVP_MD_CTX_destroy, (EVP_MD_CTX *ctx), (ctx))
@@ -584,23 +578,18 @@ int _goboringcrypto_ECDSA_verify(EVP_MD *md, const uint8_t *arg1, size_t arg2, c
584578
// Note: order of struct fields here is unchecked.
585579
typedef BN_GENCB GO_BN_GENCB;
586580

587-
int _goboringcrypto_EVP_RSA_sign(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, size_t *slen, RSA *rsa);
588-
int _goboringcrypto_EVP_RSA_verify(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, const uint8_t *sig, unsigned int slen, GO_RSA *rsa);
581+
int _goboringcrypto_RSA_sign(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, size_t *slen, RSA *rsa);
582+
int _goboringcrypto_RSA_verify(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, const uint8_t *sig, unsigned int slen, GO_RSA *rsa);
583+
584+
int _goboringcrypto_RSA_sign_raw(EVP_MD *md, const uint8_t *msg, size_t msgLen,
585+
uint8_t *sig, size_t *slen,
586+
GO_RSA *key);
587+
int _goboringcrypto_RSA_verify_raw(EVP_MD *md, const uint8_t *msg, size_t msgLen,
588+
const uint8_t *sig, unsigned int slen,
589+
GO_RSA *key);
589590

590591
DEFINEFUNC(GO_RSA *, RSA_new, (void), ())
591592
DEFINEFUNC(void, RSA_free, (GO_RSA * arg0), (arg0))
592-
DEFINEFUNC(int, RSA_private_encrypt,
593-
(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding),
594-
(flen, from, to, rsa, padding))
595-
DEFINEFUNC(int, RSA_public_decrypt,
596-
(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding),
597-
(flen, from, to, rsa, padding))
598-
DEFINEFUNC(int, RSA_sign,
599-
(int arg0, const uint8_t *arg1, unsigned int arg2, uint8_t *arg3, unsigned int *arg4, GO_RSA *arg5),
600-
(arg0, arg1, arg2, arg3, arg4, arg5))
601-
DEFINEFUNC(int, RSA_verify,
602-
(int arg0, const uint8_t *arg1, unsigned int arg2, const uint8_t *arg3, unsigned int arg4, GO_RSA *arg5),
603-
(arg0, arg1, arg2, arg3, arg4, arg5))
604593
DEFINEFUNC(int, RSA_generate_key_ex,
605594
(GO_RSA * arg0, int arg1, GO_BIGNUM *arg2, GO_BN_GENCB *arg3),
606595
(arg0, arg1, arg2, arg3))

‎openssl/notboring.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func VerifyECDSA(pub *PublicKeyECDSA, hash []byte, r, s BigInt, h crypto.Hash) b
7171
type PublicKeyECDH struct{ _ int }
7272
type PrivateKeyECDH struct{ _ int }
7373

74-
func (pc *PublicKeyECDH) Bytes() []byte { panic("boringcrypto: not available") }
74+
func (pc *PublicKeyECDH) Bytes() []byte { panic("boringcrypto: not available") }
7575
func (pc *PrivateKeyECDH) PublicKey() (*PublicKeyECDH, error) { panic("boringcrypto: not available") }
7676

7777
func NewPublicKeyECDH(curve string, bytes []byte) (*PublicKeyECDH, error) {

‎openssl/openssl_evp.c

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -38,35 +38,6 @@ int _goboringcrypto_EVP_sign(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
3838
return ret;
3939
}
4040

41-
int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *msg,
42-
size_t msgLen, uint8_t *sig, size_t *slen,
43-
GO_RSA *rsa_key) {
44-
int ret = 0;
45-
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
46-
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
47-
48-
if (!ctx && !(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
49-
goto err;
50-
51-
if (1 != _goboringcrypto_EVP_PKEY_sign_init(ctx))
52-
goto err;
53-
54-
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
55-
goto err;
56-
57-
if (1 != _goboringcrypto_EVP_PKEY_sign(ctx, sig, slen, msg, msgLen))
58-
goto err;
59-
60-
/* Success */
61-
ret = 1;
62-
63-
err:
64-
if (ctx)
65-
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
66-
67-
return ret;
68-
}
69-
7041
int _goboringcrypto_EVP_verify(EVP_MD *md, EVP_PKEY_CTX *ctx,
7142
const uint8_t *msg, size_t msgLen,
7243
const uint8_t *sig, unsigned int slen,
@@ -95,34 +66,3 @@ int _goboringcrypto_EVP_verify(EVP_MD *md, EVP_PKEY_CTX *ctx,
9566

9667
return ret;
9768
}
98-
99-
int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
100-
const uint8_t *sig, unsigned int slen,
101-
GO_RSA *rsa_key) {
102-
103-
int ret = 0;
104-
EVP_PKEY_CTX *ctx;
105-
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
106-
_goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
107-
108-
if (!(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
109-
goto err;
110-
111-
if (1 != _goboringcrypto_EVP_PKEY_verify_init(ctx))
112-
goto err;
113-
114-
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
115-
goto err;
116-
117-
if (1 != _goboringcrypto_EVP_PKEY_verify(ctx, sig, slen, msg, msgLen))
118-
goto err;
119-
120-
/* Success */
121-
ret = 1;
122-
123-
err:
124-
if (ctx)
125-
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
126-
127-
return ret;
128-
}

‎openssl/openssl_port_rsa.c

Lines changed: 87 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,9 @@ int _goboringcrypto_RSA_verify_pss_mgf1(RSA *rsa, const uint8_t *msg,
182182
return ret;
183183
}
184184

185-
int _goboringcrypto_EVP_RSA_sign(EVP_MD *md, const uint8_t *msg,
186-
unsigned int msgLen, uint8_t *sig,
187-
size_t *slen, RSA *rsa) {
185+
int _goboringcrypto_RSA_sign(EVP_MD *md, const uint8_t *msg,
186+
unsigned int msgLen, uint8_t *sig,
187+
size_t *slen, RSA *rsa) {
188188
int result;
189189
EVP_PKEY *key = _goboringcrypto_EVP_PKEY_new();
190190
if (!key) {
@@ -200,9 +200,9 @@ int _goboringcrypto_EVP_RSA_sign(EVP_MD *md, const uint8_t *msg,
200200
return result;
201201
}
202202

203-
int _goboringcrypto_EVP_RSA_verify(EVP_MD *md, const uint8_t *msg,
204-
unsigned int msgLen, const uint8_t *sig,
205-
unsigned int slen, GO_RSA *rsa) {
203+
int _goboringcrypto_RSA_verify(EVP_MD *md, const uint8_t *msg,
204+
unsigned int msgLen, const uint8_t *sig,
205+
unsigned int slen, GO_RSA *rsa) {
206206
int result;
207207
EVP_PKEY *key = _goboringcrypto_EVP_PKEY_new();
208208
if (!key) {
@@ -217,3 +217,84 @@ int _goboringcrypto_EVP_RSA_verify(EVP_MD *md, const uint8_t *msg,
217217
_goboringcrypto_EVP_PKEY_free(key);
218218
return result;
219219
}
220+
221+
int _goboringcrypto_RSA_sign_raw(EVP_MD *md, const uint8_t *msg,
222+
size_t msgLen, uint8_t *sig, size_t *slen,
223+
GO_RSA *rsa_key) {
224+
int ret = 0;
225+
GO_EVP_PKEY_CTX *ctx = NULL;
226+
GO_EVP_PKEY *pk = NULL;
227+
228+
pk = _goboringcrypto_EVP_PKEY_new();
229+
if (!pk)
230+
goto err;
231+
232+
if (1 != _goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key))
233+
goto err;
234+
235+
ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL);
236+
if (!ctx)
237+
goto err;
238+
239+
if (1 != _goboringcrypto_EVP_PKEY_sign_init(ctx))
240+
goto err;
241+
242+
if (md && 1 != _goboringcrypto_EVP_PKEY_CTX_set_signature_md(ctx, md))
243+
goto err;
244+
245+
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
246+
goto err;
247+
248+
if (1 != _goboringcrypto_EVP_PKEY_sign(ctx, sig, slen, msg, msgLen))
249+
goto err;
250+
251+
/* Success */
252+
ret = 1;
253+
254+
err:
255+
if (ctx)
256+
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
257+
258+
return ret;
259+
}
260+
261+
int _goboringcrypto_RSA_verify_raw(EVP_MD *md,
262+
const uint8_t *msg, size_t msgLen,
263+
const uint8_t *sig, unsigned int slen,
264+
GO_RSA *rsa_key) {
265+
int ret = 0;
266+
GO_EVP_PKEY_CTX *ctx = NULL;
267+
GO_EVP_PKEY *pk = NULL;
268+
269+
pk = _goboringcrypto_EVP_PKEY_new();
270+
if (!pk)
271+
goto err;
272+
273+
if (1 != _goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key))
274+
goto err;
275+
276+
ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL);
277+
if (!ctx)
278+
goto err;
279+
280+
if (1 != _goboringcrypto_EVP_PKEY_verify_init(ctx))
281+
goto err;
282+
283+
if (md && 1 != _goboringcrypto_EVP_PKEY_CTX_set_signature_md(ctx, md))
284+
goto err;
285+
286+
if (_goboringcrypto_EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
287+
goto err;
288+
289+
if (1 != _goboringcrypto_EVP_PKEY_verify(ctx, sig, slen, msg, msgLen))
290+
goto err;
291+
292+
/* Success */
293+
ret = 1;
294+
295+
err:
296+
if (ctx)
297+
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
298+
299+
return ret;
300+
}

‎openssl/rsa.go

Lines changed: 16 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,7 @@ func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen
326326

327327
func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed bool) ([]byte, error) {
328328
if h == 0 && ExecutingTest() {
329-
return signRSAPKCS1v15Raw(priv, msg, C._goboringcrypto_EVP_md_null())
329+
return signRSAPKCS1v15Raw(priv, msg, nil)
330330
}
331331

332332
md := cryptoHashToMD(h)
@@ -335,25 +335,16 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed
335335
}
336336

337337
if msgIsHashed {
338-
var out []byte
339-
var outLen C.uint
340-
PanicIfStrictFIPS("You must provide a raw unhashed message for PKCS1v15 signing and use HashSignPKCS1v15 instead of SignPKCS1v15")
341-
nid := C._goboringcrypto_EVP_MD_type(md)
342-
if priv.withKey(func(key *C.GO_RSA) C.int {
343-
out = make([]byte, C._goboringcrypto_RSA_size(key))
344-
return C._goboringcrypto_RSA_sign(nid, base(msg), C.uint(len(msg)), base(out), &outLen, key)
345-
}) == 0 {
346-
return nil, NewOpenSSLError("RSA_sign")
347-
}
348-
runtime.KeepAlive(priv)
349-
return out[:outLen], nil
338+
return signRSAPKCS1v15Raw(priv, msg, md)
350339
}
351340

352341
var out []byte
353342
var outLen C.size_t
354343

355344
if priv.withKey(func(key *C.GO_RSA) C.int {
356-
return C._goboringcrypto_EVP_RSA_sign(md, base(msg), C.uint(len(msg)), base(out), &outLen, key)
345+
out = make([]byte, C._goboringcrypto_RSA_size(key))
346+
outLen = C.size_t(len(out))
347+
return C._goboringcrypto_RSA_sign(md, base(msg), C.uint(len(msg)), base(out), &outLen, key)
357348
}) == 0 {
358349
return nil, NewOpenSSLError("RSA_sign")
359350
}
@@ -368,7 +359,7 @@ func signRSAPKCS1v15Raw(priv *PrivateKeyRSA, msg []byte, md *C.GO_EVP_MD) ([]byt
368359
if priv.withKey(func(key *C.GO_RSA) C.int {
369360
out = make([]byte, C._goboringcrypto_RSA_size(key))
370361
outLen = C.size_t(len(out))
371-
return C._goboringcrypto_EVP_sign_raw(md, nil, base(msg),
362+
return C._goboringcrypto_RSA_sign_raw(md, base(msg),
372363
C.size_t(len(msg)), base(out), &outLen, key)
373364
}) == 0 {
374365
return nil, NewOpenSSLError("RSA_sign")
@@ -379,14 +370,18 @@ func signRSAPKCS1v15Raw(priv *PrivateKeyRSA, msg []byte, md *C.GO_EVP_MD) ([]byt
379370

380371
func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsHashed bool) error {
381372
if h == 0 && ExecutingTest() {
382-
return verifyRSAPKCS1v15Raw(pub, msg, sig)
373+
return verifyRSAPKCS1v15Raw(pub, msg, sig, nil)
383374
}
384375

385376
md := cryptoHashToMD(h)
386377
if md == nil {
387378
return errors.New("crypto/rsa: unsupported hash function")
388379
}
389380

381+
if msgIsHashed {
382+
return verifyRSAPKCS1v15Raw(pub, msg, sig, md)
383+
}
384+
390385
if pub.withKey(func(key *C.GO_RSA) C.int {
391386
size := int(C._goboringcrypto_RSA_size(key))
392387
if len(sig) < size {
@@ -397,26 +392,16 @@ func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsH
397392
return errors.New("crypto/rsa: verification error")
398393
}
399394

400-
if msgIsHashed {
401-
PanicIfStrictFIPS("You must provide a raw unhashed message for PKCS1v15 verification and use HashVerifyPKCS1v15 instead of VerifyPKCS1v15")
402-
nid := C._goboringcrypto_EVP_MD_type(md)
403-
if pub.withKey(func(key *C.GO_RSA) C.int {
404-
return C._goboringcrypto_RSA_verify(nid, base(msg), C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
405-
}) == 0 {
406-
return NewOpenSSLError("RSA_verify failed")
407-
}
408-
return nil
409-
}
410-
411395
if pub.withKey(func(key *C.GO_RSA) C.int {
412-
return C._goboringcrypto_EVP_RSA_verify(md, base(msg), C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
396+
return C._goboringcrypto_RSA_verify(md, base(msg),
397+
C.uint(len(msg)), base(sig), C.uint(len(sig)), key)
413398
}) == 0 {
414399
return NewOpenSSLError("RSA_verify failed")
415400
}
416401
return nil
417402
}
418403

419-
func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte) error {
404+
func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte, md *C.GO_EVP_MD) error {
420405
if pub.withKey(func(key *C.GO_RSA) C.int {
421406
size := int(C._goboringcrypto_RSA_size(key))
422407
if len(sig) < size {
@@ -427,7 +412,8 @@ func verifyRSAPKCS1v15Raw(pub *PublicKeyRSA, msg, sig []byte) error {
427412
return errors.New("crypto/rsa: verification error")
428413
}
429414
if pub.withKey(func(key *C.GO_RSA) C.int {
430-
return C._goboringcrypto_EVP_verify_raw(base(msg), C.size_t(len(msg)), base(sig), C.uint(len(sig)), key)
415+
return C._goboringcrypto_RSA_verify_raw(md, base(msg),
416+
C.size_t(len(msg)), base(sig), C.uint(len(sig)), key)
431417
}) == 0 {
432418
return NewOpenSSLError("RSA_verify failed")
433419
}

0 commit comments

Comments
 (0)