Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher

[openssl.git] / crypto / rsa / rsa.h

diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h
index 2dd403b81bc4c0990c703c275cebaccb42391a8c..c8b6a814a0983dc3ccd34a0a958483ce25a886c4 100644 (file)
--- a/crypto/rsa/rsa.h
+++ b/crypto/rsa/rsa.h
@@ -117,7 +117,8 @@ struct rsa_meth_st
                unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
        int (*rsa_verify)(int dtype,
                const unsigned char *m, unsigned int m_length,
-               unsigned char *sigbuf, unsigned int siglen, const RSA *rsa);
+               const unsigned char *sigbuf, unsigned int siglen,
+                                                               const RSA *rsa);
 /* If this callback is NULL, the builtin software RSA key-gen will be used. This
  * is for behavioural compatibility whilst the code gets rewired, but one day
  * it would be nice to assume there are no such things as "builtin software"
@@ -192,11 +193,37 @@ struct rsa_st
                                                 * be used for all exponents.
                                                 */
 
+#define EVP_PKEY_CTX_set_rsa_padding(ctx, pad) \
+       EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, \
+                               pad, NULL)
+
+#define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) \
+       EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, \
+                               (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \
+                               EVP_PKEY_CTRL_RSA_PSS_SALTLEN, \
+                               len, NULL)
+
+#define EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) \
+       EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \
+                               EVP_PKEY_CTRL_RSA_KEYGEN_BITS, bits, NULL)
+
+#define EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp) \
+       EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_KEYGEN, \
+                               EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp)
+
+#define EVP_PKEY_CTRL_RSA_PADDING      (EVP_PKEY_ALG_CTRL + 1)
+#define EVP_PKEY_CTRL_RSA_PSS_SALTLEN  (EVP_PKEY_ALG_CTRL + 2)
+
+#define EVP_PKEY_CTRL_RSA_KEYGEN_BITS  (EVP_PKEY_ALG_CTRL + 3)
+#define EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP        (EVP_PKEY_ALG_CTRL + 4)
+
 #define RSA_PKCS1_PADDING      1
 #define RSA_SSLV23_PADDING     2
 #define RSA_NO_PADDING         3
 #define RSA_PKCS1_OAEP_PADDING 4
 #define RSA_X931_PADDING       5
+/* EVP_PKEY_ only */
+#define RSA_PKCS1_PSS_PADDING  6
 
 #define RSA_PKCS1_PADDING_SIZE 11
 
@@ -275,7 +302,7 @@ RSA *d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length,
 int RSA_sign(int type, const unsigned char *m, unsigned int m_length,
        unsigned char *sigret, unsigned int *siglen, RSA *rsa);
 int RSA_verify(int type, const unsigned char *m, unsigned int m_length,
-       unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
+       const unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
 
 /* The following 2 function sign and verify a ASN1_OCTET_STRING
  * object inside PKCS#1 padded RSA encryption */
@@ -320,6 +347,12 @@ int RSA_padding_check_X931(unsigned char *to,int tlen,
        const unsigned char *f,int fl,int rsa_len);
 int RSA_X931_hash_id(int nid);
 
+int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash,
+                       const EVP_MD *Hash, const unsigned char *EM, int sLen);
+int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
+                       const unsigned char *mHash,
+                       const EVP_MD *Hash, int sLen);
+
 int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
        CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int RSA_set_ex_data(RSA *r,int idx,void *arg);
@@ -337,7 +370,15 @@ void ERR_load_RSA_strings(void);
 /* Error codes for the RSA functions. */
 
 /* Function codes. */
+#define RSA_F_CHECK_PADDING_MD                          140
+#define RSA_F_DO_RSA_PRINT                              146
+#define RSA_F_RSA_VERIFY                                119
 #define RSA_F_MEMORY_LOCK                               100
+#define RSA_F_OLD_RSA_PRIV_DECODE                       147
+#define RSA_F_PKEY_RSA_CTRL                             143
+#define RSA_F_PKEY_RSA_CTRL_STR                                 144
+#define RSA_F_PKEY_RSA_SIGN                             142
+#define RSA_F_PKEY_RSA_VERIFYRECOVER                    141
 #define RSA_F_RSA_BUILTIN_KEYGEN                        129
 #define RSA_F_RSA_CHECK_KEY                             123
 #define RSA_F_RSA_EAY_PRIVATE_DECRYPT                   101
@@ -368,10 +409,13 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_PADDING_CHECK_X931                    128
 #define RSA_F_RSA_PRINT                                         115
 #define RSA_F_RSA_PRINT_FP                              116
+#define RSA_F_RSA_PRIV_DECODE                           137
+#define RSA_F_RSA_PRIV_ENCODE                           138
+#define RSA_F_RSA_PUB_DECODE                            139
 #define RSA_F_RSA_SETUP_BLINDING                        136
 #define RSA_F_RSA_SIGN                                  117
 #define RSA_F_RSA_SIGN_ASN1_OCTET_STRING                118
-#define RSA_F_RSA_VERIFY                                119
+#define RSA_F_INT_RSA_VERIFY                            145
 #define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING              120
 #define RSA_F_RSA_VERIFY_PKCS1_PSS                      126
 
@@ -394,10 +438,17 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_DMQ1_NOT_CONGRUENT_TO_D                   125
 #define RSA_R_D_E_NOT_CONGRUENT_TO_1                    123
 #define RSA_R_FIRST_OCTET_INVALID                       133
+#define RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE       144
+#define RSA_R_INVALID_DIGEST                            105
+#define RSA_R_INVALID_DIGEST_LENGTH                     143
 #define RSA_R_INVALID_HEADER                            137
+#define RSA_R_INVALID_KEYBITS                           145
 #define RSA_R_INVALID_MESSAGE_LENGTH                    131
 #define RSA_R_INVALID_PADDING                           138
+#define RSA_R_INVALID_PADDING_MODE                      141
+#define RSA_R_INVALID_PSS_SALTLEN                       146
 #define RSA_R_INVALID_TRAILER                           139
+#define RSA_R_INVALID_X931_DIGEST                       142
 #define RSA_R_IQMP_NOT_INVERSE_OF_Q                     126
 #define RSA_R_KEY_SIZE_TOO_SMALL                        120
 #define RSA_R_LAST_OCTET_INVALID                        134
@@ -405,17 +456,19 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                         113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q                      127
 #define RSA_R_OAEP_DECODING_ERROR                       121
-#define RSA_R_ONE_CHECK_FAILED                          135
 #define RSA_R_PADDING_CHECK_FAILED                      114
+#define RSA_R_PKCS1_PADDING_TOO_SHORT                   105
 #define RSA_R_P_NOT_PRIME                               128
 #define RSA_R_Q_NOT_PRIME                               129
 #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED              130
+#define RSA_R_SLEN_CHECK_FAILED                                 136
+#define RSA_R_SLEN_RECOVERY_FAILED                      135
 #define RSA_R_SSLV3_ROLLBACK_ATTACK                     115
 #define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116
 #define RSA_R_UNKNOWN_ALGORITHM_TYPE                    117
 #define RSA_R_UNKNOWN_PADDING_TYPE                      118
+#define RSA_R_VALUE_MISSING                             147
 #define RSA_R_WRONG_SIGNATURE_LENGTH                    119
-#define RSA_R_ZERO_CHECK_FAILED                                 136
 
 #ifdef  __cplusplus
 }