1 // SPDX-License-Identifier: MIT OR BSD-3-Clause
6 /* Implementation of RSA signature verification which uses a pre-processed
18   uint32_t n0inv;   /* -1 / n[0] mod 2^32 */
19   uint32_t* n;      /* modulus as array (host-byte order) */
20   uint32_t* rr;     /* R^2 as array (host-byte order) */
34     goto fail;  in iavb_parse_key_data()
40     goto fail;  in iavb_parse_key_data()
46     goto fail;  in iavb_parse_key_data()
57     goto fail;  in iavb_parse_key_data()
60   key->len = h.key_num_bits / 32;  in iavb_parse_key_data()
61   key->n0inv = h.n0inv;  in iavb_parse_key_data()
62   key->n = (uint32_t*)(key + 1); /* Skip ahead sizeof(IAvbKey) bytes. */  in iavb_parse_key_data()
63   key->rr = key->n + key->len;  in iavb_parse_key_data()
65   /* Crypto-code below (modpowF4() and friends) expects the key in  in iavb_parse_key_data()
66    * little-endian format (rather than the format we're storing the  in iavb_parse_key_data()
69   for (i = 0; i < key->len; i++) {  in iavb_parse_key_data()
70     key->n[i] = avb_be32toh(((uint32_t*)n)[key->len - i - 1]);  in iavb_parse_key_data()
71     key->rr[i] = avb_be32toh(((uint32_t*)rr)[key->len - i - 1]);  in iavb_parse_key_data()
75 fail:  in iavb_parse_key_data()
86 /* a[] -= mod */
90   for (i = 0; i < key->len; ++i) {  in subM()
91     A += (uint64_t)a[i] - key->n[i];  in subM()
100   for (i = key->len; i;) {  in geM()
101     --i;  in geM()
102     if (a[i] < key->n[i]) {  in geM()
105     if (a[i] > key->n[i]) {  in geM()
118   uint32_t d0 = (uint32_t)A * key->n0inv;  in montMulAdd()
119   uint64_t B = (uint64_t)d0 * key->n[0] + (uint32_t)A;  in montMulAdd()
122   for (i = 1; i < key->len; ++i) {  in montMulAdd()
124     B = (B >> 32) + (uint64_t)d0 * key->n[i] + (uint32_t)A;  in montMulAdd()
125     c[i - 1] = (uint32_t)B;  in montMulAdd()
130   c[i - 1] = (uint32_t)A;  in montMulAdd()
140   for (i = 0; i < key->len; ++i) {  in montMul()
143   for (i = 0; i < key->len; ++i) {  in montMul()
148 /* In-place public exponentiation. (65537}
149  * Input and output big-endian byte array in inout.
152   uint32_t* a = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));  in modpowF4()
153   uint32_t* aR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));  in modpowF4()
154   uint32_t* aaR = (uint32_t*)avb_malloc(key->len * sizeof(uint32_t));  in modpowF4()
159   uint32_t* aaa = aaR; /* Re-use location. */  in modpowF4()
163   for (i = 0; i < (int)key->len; ++i) {  in modpowF4()
164     uint32_t tmp = (inout[((key->len - 1 - i) * 4) + 0] << 24) |  in modpowF4()
165                    (inout[((key->len - 1 - i) * 4) + 1] << 16) |  in modpowF4()
166                    (inout[((key->len - 1 - i) * 4) + 2] << 8) |  in modpowF4()
167                    (inout[((key->len - 1 - i) * 4) + 3] << 0);  in modpowF4()
171   montMul(key, aR, a, key->rr); /* aR = a * RR / R mod M   */  in modpowF4()
184   for (i = (int)key->len - 1; i >= 0; --i) {  in modpowF4()
230   if (sig_num_bytes != (parsed_key->len * sizeof(uint32_t))) {  in avb_rsa_verify()
235   if (padding_num_bytes != sig_num_bytes - hash_num_bytes) {  in avb_rsa_verify()
252    * avb_safe_memcmp() just to be on the safe side.  in avb_rsa_verify()