blob: 9734f6d3bd692451bcf0d91b0d5862ea4d90bbb6 [file] [log] [blame]
Tom Rini10e47792018-05-06 17:58:06 -04001// SPDX-License-Identifier: GPL-2.0+
Simon Glass35191a32013-06-13 15:10:02 -07002/*
3 * Copyright (c) 2013, Google Inc.
Simon Glass35191a32013-06-13 15:10:02 -07004 */
5
Heiko Schocherd7b42322014-03-03 12:19:30 +01006#ifndef USE_HOSTCC
Simon Glass35191a32013-06-13 15:10:02 -07007#include <common.h>
8#include <fdtdec.h>
Heiko Schocherd7b42322014-03-03 12:19:30 +01009#include <asm/types.h>
Simon Glass35191a32013-06-13 15:10:02 -070010#include <asm/byteorder.h>
Masahiro Yamada56a931c2016-09-21 11:28:55 +090011#include <linux/errno.h>
Heiko Schocherd7b42322014-03-03 12:19:30 +010012#include <asm/types.h>
Simon Glass35191a32013-06-13 15:10:02 -070013#include <asm/unaligned.h>
Ruchika Guptaa0d3ca62015-01-23 16:01:54 +053014#include <dm.h>
Heiko Schocherd7b42322014-03-03 12:19:30 +010015#else
16#include "fdt_host.h"
17#include "mkimage.h"
18#include <fdt_support.h>
19#endif
Ruchika Guptab92ebab2015-01-23 16:01:50 +053020#include <u-boot/rsa-mod-exp.h>
Jeroen Hofsteebfe88fe2014-06-12 22:27:12 +020021#include <u-boot/rsa.h>
Heiko Schocherd7b42322014-03-03 12:19:30 +010022
Michael van der Westhuizen89f4ed12014-07-02 10:17:26 +020023/* Default public exponent for backward compatibility */
24#define RSA_DEFAULT_PUBEXP 65537
25
Simon Glass35191a32013-06-13 15:10:02 -070026/**
Andrew Duda3db9ff02016-11-08 18:53:40 +000027 * rsa_verify_padding() - Verify RSA message padding is valid
28 *
29 * Verify a RSA message's padding is consistent with PKCS1.5
30 * padding as described in the RSA PKCS#1 v2.1 standard.
31 *
32 * @msg: Padded message
33 * @pad_len: Number of expected padding bytes
34 * @algo: Checksum algo structure having information on DER encoding etc.
35 * @return 0 on success, != 0 on failure
36 */
37static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
38 struct checksum_algo *algo)
39{
40 int ff_len;
41 int ret;
42
43 /* first byte must be 0x00 */
44 ret = *msg++;
45 /* second byte must be 0x01 */
46 ret |= *msg++ ^ 0x01;
47 /* next ff_len bytes must be 0xff */
48 ff_len = pad_len - algo->der_len - 3;
49 ret |= *msg ^ 0xff;
50 ret |= memcmp(msg, msg+1, ff_len-1);
51 msg += ff_len;
52 /* next byte must be 0x00 */
53 ret |= *msg++;
54 /* next der_len bytes must match der_prefix */
55 ret |= memcmp(msg, algo->der_prefix, algo->der_len);
56
57 return ret;
58}
59
Philippe Reynes12468352018-11-14 13:51:00 +010060int padding_pkcs_15_verify(struct image_sign_info *info,
61 uint8_t *msg, int msg_len,
62 const uint8_t *hash, int hash_len)
63{
64 struct checksum_algo *checksum = info->checksum;
65 int ret, pad_len = msg_len - checksum->checksum_len;
66
67 /* Check pkcs1.5 padding bytes. */
68 ret = rsa_verify_padding(msg, pad_len, checksum);
69 if (ret) {
70 debug("In RSAVerify(): Padding check failed!\n");
71 return -EINVAL;
72 }
73
74 /* Check hash. */
75 if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) {
76 debug("In RSAVerify(): Hash check failed!\n");
77 return -EACCES;
78 }
79
80 return 0;
81}
82
Philippe Reynes47d73f02018-11-14 13:51:01 +010083#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT
84static void u32_i2osp(uint32_t val, uint8_t *buf)
85{
86 buf[0] = (uint8_t)((val >> 24) & 0xff);
87 buf[1] = (uint8_t)((val >> 16) & 0xff);
88 buf[2] = (uint8_t)((val >> 8) & 0xff);
89 buf[3] = (uint8_t)((val >> 0) & 0xff);
90}
91
92/**
93 * mask_generation_function1() - generate an octet string
94 *
95 * Generate an octet string used to check rsa signature.
96 * It use an input octet string and a hash function.
97 *
98 * @checksum: A Hash function
99 * @seed: Specifies an input variable octet string
100 * @seed_len: Size of the input octet string
101 * @output: Specifies the output octet string
102 * @output_len: Size of the output octet string
103 * @return 0 if the octet string was correctly generated, others on error
104 */
105static int mask_generation_function1(struct checksum_algo *checksum,
106 uint8_t *seed, int seed_len,
107 uint8_t *output, int output_len)
108{
109 struct image_region region[2];
110 int ret = 0, i, i_output = 0, region_count = 2;
111 uint32_t counter = 0;
112 uint8_t buf_counter[4], *tmp;
113 int hash_len = checksum->checksum_len;
114
115 memset(output, 0, output_len);
116
117 region[0].data = seed;
118 region[0].size = seed_len;
119 region[1].data = &buf_counter[0];
120 region[1].size = 4;
121
122 tmp = malloc(hash_len);
123 if (!tmp) {
124 debug("%s: can't allocate array tmp\n", __func__);
125 ret = -ENOMEM;
126 goto out;
127 }
128
129 while (i_output < output_len) {
130 u32_i2osp(counter, &buf_counter[0]);
131
132 ret = checksum->calculate(checksum->name,
133 region, region_count,
134 tmp);
135 if (ret < 0) {
136 debug("%s: Error in checksum calculation\n", __func__);
137 goto out;
138 }
139
140 i = 0;
141 while ((i_output < output_len) && (i < hash_len)) {
142 output[i_output] = tmp[i];
143 i_output++;
144 i++;
145 }
146
147 counter++;
148 }
149
150out:
151 free(tmp);
152
153 return ret;
154}
155
156static int compute_hash_prime(struct checksum_algo *checksum,
157 uint8_t *pad, int pad_len,
158 uint8_t *hash, int hash_len,
159 uint8_t *salt, int salt_len,
160 uint8_t *hprime)
161{
162 struct image_region region[3];
163 int ret, region_count = 3;
164
165 region[0].data = pad;
166 region[0].size = pad_len;
167 region[1].data = hash;
168 region[1].size = hash_len;
169 region[2].data = salt;
170 region[2].size = salt_len;
171
172 ret = checksum->calculate(checksum->name, region, region_count, hprime);
173 if (ret < 0) {
174 debug("%s: Error in checksum calculation\n", __func__);
175 goto out;
176 }
177
178out:
179 return ret;
180}
181
182int padding_pss_verify(struct image_sign_info *info,
183 uint8_t *msg, int msg_len,
184 const uint8_t *hash, int hash_len)
185{
186 uint8_t *masked_db = NULL;
187 int masked_db_len = msg_len - hash_len - 1;
188 uint8_t *h = NULL, *hprime = NULL;
189 int h_len = hash_len;
190 uint8_t *db_mask = NULL;
191 int db_mask_len = masked_db_len;
192 uint8_t *db = NULL, *salt = NULL;
193 int db_len = masked_db_len, salt_len = msg_len - hash_len - 2;
194 uint8_t pad_zero[8] = { 0 };
195 int ret, i, leftmost_bits = 1;
196 uint8_t leftmost_mask;
197 struct checksum_algo *checksum = info->checksum;
198
199 /* first, allocate everything */
200 masked_db = malloc(masked_db_len);
201 h = malloc(h_len);
202 db_mask = malloc(db_mask_len);
203 db = malloc(db_len);
204 salt = malloc(salt_len);
205 hprime = malloc(hash_len);
206 if (!masked_db || !h || !db_mask || !db || !salt || !hprime) {
207 printf("%s: can't allocate some buffer\n", __func__);
208 ret = -ENOMEM;
209 goto out;
210 }
211
212 /* step 4: check if the last byte is 0xbc */
213 if (msg[msg_len - 1] != 0xbc) {
214 printf("%s: invalid pss padding (0xbc is missing)\n", __func__);
215 ret = -EINVAL;
216 goto out;
217 }
218
219 /* step 5 */
220 memcpy(masked_db, msg, masked_db_len);
221 memcpy(h, msg + masked_db_len, h_len);
222
223 /* step 6 */
224 leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits);
225 if (masked_db[0] & leftmost_mask) {
226 printf("%s: invalid pss padding ", __func__);
227 printf("(leftmost bit of maskedDB not zero)\n");
228 ret = -EINVAL;
229 goto out;
230 }
231
232 /* step 7 */
233 mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len);
234
235 /* step 8 */
236 for (i = 0; i < db_len; i++)
237 db[i] = masked_db[i] ^ db_mask[i];
238
239 /* step 9 */
240 db[0] &= 0xff >> leftmost_bits;
241
242 /* step 10 */
243 if (db[0] != 0x01) {
244 printf("%s: invalid pss padding ", __func__);
245 printf("(leftmost byte of db isn't 0x01)\n");
246 ret = EINVAL;
247 goto out;
248 }
249
250 /* step 11 */
251 memcpy(salt, &db[1], salt_len);
252
253 /* step 12 & 13 */
254 compute_hash_prime(checksum, pad_zero, 8,
255 (uint8_t *)hash, hash_len,
256 salt, salt_len, hprime);
257
258 /* step 14 */
259 ret = memcmp(h, hprime, hash_len);
260
261out:
262 free(hprime);
263 free(salt);
264 free(db);
265 free(db_mask);
266 free(h);
267 free(masked_db);
268
269 return ret;
270}
271#endif
272
Andrew Duda3db9ff02016-11-08 18:53:40 +0000273/**
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530274 * rsa_verify_key() - Verify a signature against some data using RSA Key
Simon Glass35191a32013-06-13 15:10:02 -0700275 *
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530276 * Verify a RSA PKCS1.5 signature against an expected hash using
277 * the RSA Key properties in prop structure.
Simon Glass35191a32013-06-13 15:10:02 -0700278 *
Philippe Reynes12468352018-11-14 13:51:00 +0100279 * @info: Specifies key and FIT information
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530280 * @prop: Specifies key
281 * @sig: Signature
282 * @sig_len: Number of bytes in signature
283 * @hash: Pointer to the expected hash
Andrew Duda06ca6d62016-11-08 18:53:41 +0000284 * @key_len: Number of bytes in rsa key
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530285 * @return 0 if verified, -ve on error
Simon Glass35191a32013-06-13 15:10:02 -0700286 */
Philippe Reynes12468352018-11-14 13:51:00 +0100287static int rsa_verify_key(struct image_sign_info *info,
288 struct key_prop *prop, const uint8_t *sig,
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100289 const uint32_t sig_len, const uint8_t *hash,
Philippe Reynes12468352018-11-14 13:51:00 +0100290 const uint32_t key_len)
Simon Glass35191a32013-06-13 15:10:02 -0700291{
Simon Glass35191a32013-06-13 15:10:02 -0700292 int ret;
Ruchika Guptaa0d3ca62015-01-23 16:01:54 +0530293#if !defined(USE_HOSTCC)
294 struct udevice *mod_exp_dev;
295#endif
Philippe Reynes12468352018-11-14 13:51:00 +0100296 struct checksum_algo *checksum = info->checksum;
297 struct padding_algo *padding = info->padding;
298 int hash_len = checksum->checksum_len;
Simon Glass35191a32013-06-13 15:10:02 -0700299
Philippe Reynes12468352018-11-14 13:51:00 +0100300 if (!prop || !sig || !hash || !checksum)
Simon Glass35191a32013-06-13 15:10:02 -0700301 return -EIO;
302
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530303 if (sig_len != (prop->num_bits / 8)) {
Simon Glass35191a32013-06-13 15:10:02 -0700304 debug("Signature is of incorrect length %d\n", sig_len);
305 return -EINVAL;
306 }
307
Philippe Reynes12468352018-11-14 13:51:00 +0100308 debug("Checksum algorithm: %s", checksum->name);
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100309
Simon Glass35191a32013-06-13 15:10:02 -0700310 /* Sanity check for stack size */
311 if (sig_len > RSA_MAX_SIG_BITS / 8) {
312 debug("Signature length %u exceeds maximum %d\n", sig_len,
313 RSA_MAX_SIG_BITS / 8);
314 return -EINVAL;
315 }
316
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530317 uint8_t buf[sig_len];
Simon Glass35191a32013-06-13 15:10:02 -0700318
Ruchika Guptaa0d3ca62015-01-23 16:01:54 +0530319#if !defined(USE_HOSTCC)
320 ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
321 if (ret) {
322 printf("RSA: Can't find Modular Exp implementation\n");
323 return -EINVAL;
324 }
325
326 ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
327#else
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530328 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
Ruchika Guptaa0d3ca62015-01-23 16:01:54 +0530329#endif
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530330 if (ret) {
331 debug("Error in Modular exponentation\n");
Simon Glass35191a32013-06-13 15:10:02 -0700332 return ret;
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530333 }
Simon Glass35191a32013-06-13 15:10:02 -0700334
Philippe Reynes12468352018-11-14 13:51:00 +0100335 ret = padding->verify(info, buf, key_len, hash, hash_len);
Andrew Duda3db9ff02016-11-08 18:53:40 +0000336 if (ret) {
Philippe Reynes12468352018-11-14 13:51:00 +0100337 debug("In RSAVerify(): padding check failed!\n");
338 return ret;
Simon Glass35191a32013-06-13 15:10:02 -0700339 }
340
341 return 0;
342}
343
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530344/**
345 * rsa_verify_with_keynode() - Verify a signature against some data using
346 * information in node with prperties of RSA Key like modulus, exponent etc.
347 *
348 * Parse sign-node and fill a key_prop structure with properties of the
349 * key. Verify a RSA PKCS1.5 signature against an expected hash using
350 * the properties parsed
351 *
352 * @info: Specifies key and FIT information
353 * @hash: Pointer to the expected hash
354 * @sig: Signature
355 * @sig_len: Number of bytes in signature
356 * @node: Node having the RSA Key properties
357 * @return 0 if verified, -ve on error
358 */
Simon Glass35191a32013-06-13 15:10:02 -0700359static int rsa_verify_with_keynode(struct image_sign_info *info,
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530360 const void *hash, uint8_t *sig,
361 uint sig_len, int node)
Simon Glass35191a32013-06-13 15:10:02 -0700362{
363 const void *blob = info->fdt_blob;
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530364 struct key_prop prop;
Michael van der Westhuizen89f4ed12014-07-02 10:17:26 +0200365 int length;
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530366 int ret = 0;
Simon Glass35191a32013-06-13 15:10:02 -0700367
368 if (node < 0) {
369 debug("%s: Skipping invalid node", __func__);
370 return -EBADF;
371 }
Simon Glass35191a32013-06-13 15:10:02 -0700372
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530373 prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
Simon Glass35191a32013-06-13 15:10:02 -0700374
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530375 prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
Simon Glass35191a32013-06-13 15:10:02 -0700376
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530377 prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
378 if (!prop.public_exponent || length < sizeof(uint64_t))
379 prop.public_exponent = NULL;
380
381 prop.exp_len = sizeof(uint64_t);
382
383 prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
384
385 prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
386
387 if (!prop.num_bits || !prop.modulus) {
388 debug("%s: Missing RSA key info", __func__);
389 return -EFAULT;
Simon Glass35191a32013-06-13 15:10:02 -0700390 }
391
Philippe Reynes12468352018-11-14 13:51:00 +0100392 ret = rsa_verify_key(info, &prop, sig, sig_len, hash,
393 info->crypto->key_len);
Ruchika Guptab92ebab2015-01-23 16:01:50 +0530394
395 return ret;
Simon Glass35191a32013-06-13 15:10:02 -0700396}
397
398int rsa_verify(struct image_sign_info *info,
399 const struct image_region region[], int region_count,
400 uint8_t *sig, uint sig_len)
401{
402 const void *blob = info->fdt_blob;
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100403 /* Reserve memory for maximum checksum-length */
Andrew Duda6616c822016-11-08 18:53:41 +0000404 uint8_t hash[info->crypto->key_len];
Simon Glass35191a32013-06-13 15:10:02 -0700405 int ndepth, noffset;
406 int sig_node, node;
407 char name[100];
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100408 int ret;
409
410 /*
411 * Verify that the checksum-length does not exceed the
412 * rsa-signature-length
413 */
Andrew Duda6616c822016-11-08 18:53:41 +0000414 if (info->checksum->checksum_len >
415 info->crypto->key_len) {
Heiko Schocher4b817562014-03-03 12:19:27 +0100416 debug("%s: invlaid checksum-algorithm %s for %s\n",
Andrew Duda6616c822016-11-08 18:53:41 +0000417 __func__, info->checksum->name, info->crypto->name);
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100418 return -EINVAL;
419 }
Simon Glass35191a32013-06-13 15:10:02 -0700420
421 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
422 if (sig_node < 0) {
423 debug("%s: No signature node found\n", __func__);
424 return -ENOENT;
425 }
426
Heiko Schocheredaf9b12014-03-03 12:19:26 +0100427 /* Calculate checksum with checksum-algorithm */
Andrew Duda6616c822016-11-08 18:53:41 +0000428 ret = info->checksum->calculate(info->checksum->name,
Ruchika Gupta2c8987f2015-01-23 16:01:59 +0530429 region, region_count, hash);
430 if (ret < 0) {
431 debug("%s: Error in checksum calculation\n", __func__);
432 return -EINVAL;
433 }
Simon Glass35191a32013-06-13 15:10:02 -0700434
435 /* See if we must use a particular key */
436 if (info->required_keynode != -1) {
437 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
438 info->required_keynode);
439 if (!ret)
440 return ret;
441 }
442
443 /* Look for a key that matches our hint */
444 snprintf(name, sizeof(name), "key-%s", info->keyname);
445 node = fdt_subnode_offset(blob, sig_node, name);
446 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
447 if (!ret)
448 return ret;
449
450 /* No luck, so try each of the keys in turn */
451 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
452 (noffset >= 0) && (ndepth > 0);
453 noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
454 if (ndepth == 1 && noffset != node) {
455 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
456 noffset);
457 if (!ret)
458 break;
459 }
460 }
461
462 return ret;
463}