1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (c) 2013, Google Inc.
4 */
5
6 #ifndef USE_HOSTCC
7 #include <common.h>
8 #include <fdtdec.h>
9 #include <asm/types.h>
10 #include <asm/byteorder.h>
11 #include <linux/errno.h>
12 #include <asm/types.h>
13 #include <asm/unaligned.h>
14 #include <dm.h>
15 #else
16 #include "fdt_host.h"
17 #include "mkimage.h"
18 #include <fdt_support.h>
19 #endif
20 #include <u-boot/rsa-mod-exp.h>
21 #include <u-boot/rsa.h>
22
23 /* Default public exponent for backward compatibility */
24 #define RSA_DEFAULT_PUBEXP 65537
25
26 /**
27 * rsa_verify_padding() - Verify RSA message padding is valid
28 *
29 * Verify a RSA message's padding is consistent with PKCS1.5
30 * padding as described in the RSA PKCS#1 v2.1 standard.
31 *
32 * @msg: Padded message
33 * @pad_len: Number of expected padding bytes
34 * @algo: Checksum algo structure having information on DER encoding etc.
35 * @return 0 on success, != 0 on failure
36 */
rsa_verify_padding(const uint8_t * msg,const int pad_len,struct checksum_algo * algo)37 static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
38 struct checksum_algo *algo)
39 {
40 int ff_len;
41 int ret;
42
43 /* first byte must be 0x00 */
44 ret = *msg++;
45 /* second byte must be 0x01 */
46 ret |= *msg++ ^ 0x01;
47 /* next ff_len bytes must be 0xff */
48 ff_len = pad_len - algo->der_len - 3;
49 ret |= *msg ^ 0xff;
50 ret |= memcmp(msg, msg+1, ff_len-1);
51 msg += ff_len;
52 /* next byte must be 0x00 */
53 ret |= *msg++;
54 /* next der_len bytes must match der_prefix */
55 ret |= memcmp(msg, algo->der_prefix, algo->der_len);
56
57 return ret;
58 }
59
padding_pkcs_15_verify(struct image_sign_info * info,uint8_t * msg,int msg_len,const uint8_t * hash,int hash_len)60 int padding_pkcs_15_verify(struct image_sign_info *info,
61 uint8_t *msg, int msg_len,
62 const uint8_t *hash, int hash_len)
63 {
64 struct checksum_algo *checksum = info->checksum;
65 int ret, pad_len = msg_len - checksum->checksum_len;
66
67 /* Check pkcs1.5 padding bytes. */
68 ret = rsa_verify_padding(msg, pad_len, checksum);
69 if (ret) {
70 debug("In RSAVerify(): Padding check failed!\n");
71 return -EINVAL;
72 }
73
74 /* Check hash. */
75 if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) {
76 debug("In RSAVerify(): Hash check failed!\n");
77 return -EACCES;
78 }
79
80 return 0;
81 }
82
83 #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT
u32_i2osp(uint32_t val,uint8_t * buf)84 static void u32_i2osp(uint32_t val, uint8_t *buf)
85 {
86 buf[0] = (uint8_t)((val >> 24) & 0xff);
87 buf[1] = (uint8_t)((val >> 16) & 0xff);
88 buf[2] = (uint8_t)((val >> 8) & 0xff);
89 buf[3] = (uint8_t)((val >> 0) & 0xff);
90 }
91
92 /**
93 * mask_generation_function1() - generate an octet string
94 *
95 * Generate an octet string used to check rsa signature.
96 * It use an input octet string and a hash function.
97 *
98 * @checksum: A Hash function
99 * @seed: Specifies an input variable octet string
100 * @seed_len: Size of the input octet string
101 * @output: Specifies the output octet string
102 * @output_len: Size of the output octet string
103 * @return 0 if the octet string was correctly generated, others on error
104 */
mask_generation_function1(struct checksum_algo * checksum,uint8_t * seed,int seed_len,uint8_t * output,int output_len)105 static int mask_generation_function1(struct checksum_algo *checksum,
106 uint8_t *seed, int seed_len,
107 uint8_t *output, int output_len)
108 {
109 struct image_region region[2];
110 int ret = 0, i, i_output = 0, region_count = 2;
111 uint32_t counter = 0;
112 uint8_t buf_counter[4], *tmp;
113 int hash_len = checksum->checksum_len;
114
115 memset(output, 0, output_len);
116
117 region[0].data = seed;
118 region[0].size = seed_len;
119 region[1].data = &buf_counter[0];
120 region[1].size = 4;
121
122 tmp = malloc(hash_len);
123 if (!tmp) {
124 debug("%s: can't allocate array tmp\n", __func__);
125 ret = -ENOMEM;
126 goto out;
127 }
128
129 while (i_output < output_len) {
130 u32_i2osp(counter, &buf_counter[0]);
131
132 ret = checksum->calculate(checksum->name,
133 region, region_count,
134 tmp);
135 if (ret < 0) {
136 debug("%s: Error in checksum calculation\n", __func__);
137 goto out;
138 }
139
140 i = 0;
141 while ((i_output < output_len) && (i < hash_len)) {
142 output[i_output] = tmp[i];
143 i_output++;
144 i++;
145 }
146
147 counter++;
148 }
149
150 out:
151 free(tmp);
152
153 return ret;
154 }
155
compute_hash_prime(struct checksum_algo * checksum,uint8_t * pad,int pad_len,uint8_t * hash,int hash_len,uint8_t * salt,int salt_len,uint8_t * hprime)156 static int compute_hash_prime(struct checksum_algo *checksum,
157 uint8_t *pad, int pad_len,
158 uint8_t *hash, int hash_len,
159 uint8_t *salt, int salt_len,
160 uint8_t *hprime)
161 {
162 struct image_region region[3];
163 int ret, region_count = 3;
164
165 region[0].data = pad;
166 region[0].size = pad_len;
167 region[1].data = hash;
168 region[1].size = hash_len;
169 region[2].data = salt;
170 region[2].size = salt_len;
171
172 ret = checksum->calculate(checksum->name, region, region_count, hprime);
173 if (ret < 0) {
174 debug("%s: Error in checksum calculation\n", __func__);
175 goto out;
176 }
177
178 out:
179 return ret;
180 }
181
padding_pss_verify(struct image_sign_info * info,uint8_t * msg,int msg_len,const uint8_t * hash,int hash_len)182 int padding_pss_verify(struct image_sign_info *info,
183 uint8_t *msg, int msg_len,
184 const uint8_t *hash, int hash_len)
185 {
186 uint8_t *masked_db = NULL;
187 int masked_db_len = msg_len - hash_len - 1;
188 uint8_t *h = NULL, *hprime = NULL;
189 int h_len = hash_len;
190 uint8_t *db_mask = NULL;
191 int db_mask_len = masked_db_len;
192 uint8_t *db = NULL, *salt = NULL;
193 int db_len = masked_db_len, salt_len = msg_len - hash_len - 2;
194 uint8_t pad_zero[8] = { 0 };
195 int ret, i, leftmost_bits = 1;
196 uint8_t leftmost_mask;
197 struct checksum_algo *checksum = info->checksum;
198
199 /* first, allocate everything */
200 masked_db = malloc(masked_db_len);
201 h = malloc(h_len);
202 db_mask = malloc(db_mask_len);
203 db = malloc(db_len);
204 salt = malloc(salt_len);
205 hprime = malloc(hash_len);
206 if (!masked_db || !h || !db_mask || !db || !salt || !hprime) {
207 printf("%s: can't allocate some buffer\n", __func__);
208 ret = -ENOMEM;
209 goto out;
210 }
211
212 /* step 4: check if the last byte is 0xbc */
213 if (msg[msg_len - 1] != 0xbc) {
214 printf("%s: invalid pss padding (0xbc is missing)\n", __func__);
215 ret = -EINVAL;
216 goto out;
217 }
218
219 /* step 5 */
220 memcpy(masked_db, msg, masked_db_len);
221 memcpy(h, msg + masked_db_len, h_len);
222
223 /* step 6 */
224 leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits);
225 if (masked_db[0] & leftmost_mask) {
226 printf("%s: invalid pss padding ", __func__);
227 printf("(leftmost bit of maskedDB not zero)\n");
228 ret = -EINVAL;
229 goto out;
230 }
231
232 /* step 7 */
233 mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len);
234
235 /* step 8 */
236 for (i = 0; i < db_len; i++)
237 db[i] = masked_db[i] ^ db_mask[i];
238
239 /* step 9 */
240 db[0] &= 0xff >> leftmost_bits;
241
242 /* step 10 */
243 if (db[0] != 0x01) {
244 printf("%s: invalid pss padding ", __func__);
245 printf("(leftmost byte of db isn't 0x01)\n");
246 ret = EINVAL;
247 goto out;
248 }
249
250 /* step 11 */
251 memcpy(salt, &db[1], salt_len);
252
253 /* step 12 & 13 */
254 compute_hash_prime(checksum, pad_zero, 8,
255 (uint8_t *)hash, hash_len,
256 salt, salt_len, hprime);
257
258 /* step 14 */
259 ret = memcmp(h, hprime, hash_len);
260
261 out:
262 free(hprime);
263 free(salt);
264 free(db);
265 free(db_mask);
266 free(h);
267 free(masked_db);
268
269 return ret;
270 }
271 #endif
272
273 /**
274 * rsa_verify_key() - Verify a signature against some data using RSA Key
275 *
276 * Verify a RSA PKCS1.5 signature against an expected hash using
277 * the RSA Key properties in prop structure.
278 *
279 * @info: Specifies key and FIT information
280 * @prop: Specifies key
281 * @sig: Signature
282 * @sig_len: Number of bytes in signature
283 * @hash: Pointer to the expected hash
284 * @key_len: Number of bytes in rsa key
285 * @return 0 if verified, -ve on error
286 */
rsa_verify_key(struct image_sign_info * info,struct key_prop * prop,const uint8_t * sig,const uint32_t sig_len,const uint8_t * hash,const uint32_t key_len)287 static int rsa_verify_key(struct image_sign_info *info,
288 struct key_prop *prop, const uint8_t *sig,
289 const uint32_t sig_len, const uint8_t *hash,
290 const uint32_t key_len)
291 {
292 int ret;
293 #if !defined(USE_HOSTCC)
294 struct udevice *mod_exp_dev;
295 #endif
296 struct checksum_algo *checksum = info->checksum;
297 struct padding_algo *padding = info->padding;
298 int hash_len;
299
300 if (!prop || !sig || !hash || !checksum)
301 return -EIO;
302
303 if (sig_len != (prop->num_bits / 8)) {
304 debug("Signature is of incorrect length %d\n", sig_len);
305 return -EINVAL;
306 }
307
308 debug("Checksum algorithm: %s", checksum->name);
309
310 /* Sanity check for stack size */
311 if (sig_len > RSA_MAX_SIG_BITS / 8) {
312 debug("Signature length %u exceeds maximum %d\n", sig_len,
313 RSA_MAX_SIG_BITS / 8);
314 return -EINVAL;
315 }
316
317 uint8_t buf[sig_len];
318 hash_len = checksum->checksum_len;
319
320 #if !defined(USE_HOSTCC)
321 ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
322 if (ret) {
323 printf("RSA: Can't find Modular Exp implementation\n");
324 return -EINVAL;
325 }
326
327 ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
328 #else
329 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
330 #endif
331 if (ret) {
332 debug("Error in Modular exponentation\n");
333 return ret;
334 }
335
336 ret = padding->verify(info, buf, key_len, hash, hash_len);
337 if (ret) {
338 debug("In RSAVerify(): padding check failed!\n");
339 return ret;
340 }
341
342 return 0;
343 }
344
345 /**
346 * rsa_verify_with_keynode() - Verify a signature against some data using
347 * information in node with prperties of RSA Key like modulus, exponent etc.
348 *
349 * Parse sign-node and fill a key_prop structure with properties of the
350 * key. Verify a RSA PKCS1.5 signature against an expected hash using
351 * the properties parsed
352 *
353 * @info: Specifies key and FIT information
354 * @hash: Pointer to the expected hash
355 * @sig: Signature
356 * @sig_len: Number of bytes in signature
357 * @node: Node having the RSA Key properties
358 * @return 0 if verified, -ve on error
359 */
rsa_verify_with_keynode(struct image_sign_info * info,const void * hash,uint8_t * sig,uint sig_len,int node)360 static int rsa_verify_with_keynode(struct image_sign_info *info,
361 const void *hash, uint8_t *sig,
362 uint sig_len, int node)
363 {
364 const void *blob = info->fdt_blob;
365 struct key_prop prop;
366 int length;
367 int ret = 0;
368
369 if (node < 0) {
370 debug("%s: Skipping invalid node", __func__);
371 return -EBADF;
372 }
373
374 prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
375
376 prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
377
378 prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
379 if (!prop.public_exponent || length < sizeof(uint64_t))
380 prop.public_exponent = NULL;
381
382 prop.exp_len = sizeof(uint64_t);
383
384 prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
385
386 prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
387
388 if (!prop.num_bits || !prop.modulus) {
389 debug("%s: Missing RSA key info", __func__);
390 return -EFAULT;
391 }
392
393 ret = rsa_verify_key(info, &prop, sig, sig_len, hash,
394 info->crypto->key_len);
395
396 return ret;
397 }
398
rsa_verify(struct image_sign_info * info,const struct image_region region[],int region_count,uint8_t * sig,uint sig_len)399 int rsa_verify(struct image_sign_info *info,
400 const struct image_region region[], int region_count,
401 uint8_t *sig, uint sig_len)
402 {
403 const void *blob = info->fdt_blob;
404 /* Reserve memory for maximum checksum-length */
405 uint8_t hash[info->crypto->key_len];
406 int ndepth, noffset;
407 int sig_node, node;
408 char name[100];
409 int ret;
410
411 /*
412 * Verify that the checksum-length does not exceed the
413 * rsa-signature-length
414 */
415 if (info->checksum->checksum_len >
416 info->crypto->key_len) {
417 debug("%s: invlaid checksum-algorithm %s for %s\n",
418 __func__, info->checksum->name, info->crypto->name);
419 return -EINVAL;
420 }
421
422 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
423 if (sig_node < 0) {
424 debug("%s: No signature node found\n", __func__);
425 return -ENOENT;
426 }
427
428 /* Calculate checksum with checksum-algorithm */
429 ret = info->checksum->calculate(info->checksum->name,
430 region, region_count, hash);
431 if (ret < 0) {
432 debug("%s: Error in checksum calculation\n", __func__);
433 return -EINVAL;
434 }
435
436 /* See if we must use a particular key */
437 if (info->required_keynode != -1) {
438 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
439 info->required_keynode);
440 if (!ret)
441 return ret;
442 }
443
444 /* Look for a key that matches our hint */
445 snprintf(name, sizeof(name), "key-%s", info->keyname);
446 node = fdt_subnode_offset(blob, sig_node, name);
447 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
448 if (!ret)
449 return ret;
450
451 /* No luck, so try each of the keys in turn */
452 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
453 (noffset >= 0) && (ndepth > 0);
454 noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
455 if (ndepth == 1 && noffset != node) {
456 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
457 noffset);
458 if (!ret)
459 break;
460 }
461 }
462
463 return ret;
464 }
465