RSA: Implement signature verification algorithm [PKCS#1 / RFC3447]

Implement RSA public key cryptography [PKCS#1 / RFC3447].  At this time, only
the signature verification algorithm is supported.  This uses the asymmetric
public key subtype to hold its key data.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

4 files changed, 279 insertions, 0 deletions

diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index bbfccaa35293..561759d6a65f 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -18,4 +18,11 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
           appropriate hash algorithms (such as SHA-1) must be available.
           ENOPKG will be reported if the requisite algorithm is unavailable.
 
+config PUBLIC_KEY_ALGO_RSA
+        tristate "RSA public-key algorithm"
+        depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+        select MPILIB_EXTRA
+        help
+          This option enables support for the RSA algorithm (PKCS#1, RFC3447).
+
 endif # ASYMMETRIC_KEY_TYPE
diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
index 8dcdf0cdb261..7c92691a45eb 100644
--- a/crypto/asymmetric_keys/Makefile
+++ b/crypto/asymmetric_keys/Makefile
@@ -7,3 +7,4 @@ obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += asymmetric_keys.o
 asymmetric_keys-y := asymmetric_type.o signature.o
 
 obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o
+obj-$(CONFIG_PUBLIC_KEY_ALGO_RSA) += rsa.o
diff --git a/crypto/asymmetric_keys/public_key.h b/crypto/asymmetric_keys/public_key.h
index 1f86aad31003..5e5e35626899 100644
--- a/crypto/asymmetric_keys/public_key.h
+++ b/crypto/asymmetric_keys/public_key.h
@@ -26,3 +26,5 @@ struct public_key_algorithm {
         int (*verify_signature)(const struct public_key *key,
                                 const struct public_key_signature *sig);
 };
+
+extern const struct public_key_algorithm RSA_public_key_algorithm;
diff --git a/crypto/asymmetric_keys/rsa.c b/crypto/asymmetric_keys/rsa.c
new file mode 100644
index 000000000000..9b31ee25a459
--- /dev/null
+++ b/crypto/asymmetric_keys/rsa.c
@@ -0,0 +1,269 @@
+/* RSA asymmetric public-key algorithm [RFC3447]
+ *
+ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) "RSA: "fmt
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include "public_key.h"
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RSA Public Key Algorithm");
+
+#define kenter(FMT, ...) \
+        pr_devel("==> %s("FMT")\n", __func__, ##__VA_ARGS__)
+#define kleave(FMT, ...) \
+        pr_devel("<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
+
+/*
+ * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
+ */
+static const u8 RSA_digest_info_MD5[] = {
+        0x30, 0x20, 0x30, 0x0C, 0x06, 0x08,
+        0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, /* OID */
+        0x05, 0x00, 0x04, 0x10
+};
+
+static const u8 RSA_digest_info_SHA1[] = {
+        0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+        0x2B, 0x0E, 0x03, 0x02, 0x1A,
+        0x05, 0x00, 0x04, 0x14
+};
+
+static const u8 RSA_digest_info_RIPE_MD_160[] = {
+        0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
+        0x2B, 0x24, 0x03, 0x02, 0x01,
+        0x05, 0x00, 0x04, 0x14
+};
+
+static const u8 RSA_digest_info_SHA224[] = {
+        0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
+        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
+        0x05, 0x00, 0x04, 0x1C
+};
+
+static const u8 RSA_digest_info_SHA256[] = {
+        0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
+        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
+        0x05, 0x00, 0x04, 0x20
+};
+
+static const u8 RSA_digest_info_SHA384[] = {
+        0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
+        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
+        0x05, 0x00, 0x04, 0x30
+};
+
+static const u8 RSA_digest_info_SHA512[] = {
+        0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
+        0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
+        0x05, 0x00, 0x04, 0x40
+};
+
+static const struct {
+        const u8 *data;
+        size_t size;
+} RSA_ASN1_templates[PKEY_HASH__LAST] = {
+#define _(X) { RSA_digest_info_##X, sizeof(RSA_digest_info_##X) }
+        [PKEY_HASH_MD5]         = _(MD5),
+        [PKEY_HASH_SHA1]        = _(SHA1),
+        [PKEY_HASH_RIPE_MD_160] = _(RIPE_MD_160),
+        [PKEY_HASH_SHA256]      = _(SHA256),
+        [PKEY_HASH_SHA384]      = _(SHA384),
+        [PKEY_HASH_SHA512]      = _(SHA512),
+        [PKEY_HASH_SHA224]      = _(SHA224),
+#undef _
+};
+
+/*
+ * RSAVP1() function [RFC3447 sec 5.2.2]
+ */
+static int RSAVP1(const struct public_key *key, MPI s, MPI *_m)
+{
+        MPI m;
+        int ret;
+
+        /* (1) Validate 0 <= s < n */
+        if (mpi_cmp_ui(s, 0) < 0) {
+                kleave(" = -EBADMSG [s < 0]");
+                return -EBADMSG;
+        }
+        if (mpi_cmp(s, key->rsa.n) >= 0) {
+                kleave(" = -EBADMSG [s >= n]");
+                return -EBADMSG;
+        }
+
+        m = mpi_alloc(0);
+        if (!m)
+                return -ENOMEM;
+
+        /* (2) m = s^e mod n */
+        ret = mpi_powm(m, s, key->rsa.e, key->rsa.n);
+        if (ret < 0) {
+                mpi_free(m);
+                return ret;
+        }
+
+        *_m = m;
+        return 0;
+}
+
+/*
+ * Integer to Octet String conversion [RFC3447 sec 4.1]
+ */
+static int RSA_I2OSP(MPI x, size_t xLen, u8 **_X)
+{
+        unsigned X_size, x_size;
+        int X_sign;
+        u8 *X;
+
+        /* Make sure the string is the right length.  The number should begin
+         * with { 0x00, 0x01, ... } so we have to account for 15 leading zero
+         * bits not being reported by MPI.
+         */
+        x_size = mpi_get_nbits(x);
+        pr_devel("size(x)=%u xLen*8=%zu\n", x_size, xLen * 8);
+        if (x_size != xLen * 8 - 15)
+                return -ERANGE;
+
+        X = mpi_get_buffer(x, &X_size, &X_sign);
+        if (!X)
+                return -ENOMEM;
+        if (X_sign < 0) {
+                kfree(X);
+                return -EBADMSG;
+        }
+        if (X_size != xLen - 1) {
+                kfree(X);
+                return -EBADMSG;
+        }
+
+        *_X = X;
+        return 0;
+}
+
+/*
+ * Perform the RSA signature verification.
+ * @H: Value of hash of data and metadata
+ * @EM: The computed signature value
+ * @k: The size of EM (EM[0] is an invalid location but should hold 0x00)
+ * @hash_size: The size of H
+ * @asn1_template: The DigestInfo ASN.1 template
+ * @asn1_siz