1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (c) 2013, Google Inc.
10 #include <asm/byteorder.h>
11 #include <linux/errno.h>
12 #include <asm/types.h>
13 #include <asm/unaligned.h>
18 #include <fdt_support.h>
20 #include <u-boot/rsa-mod-exp.h>
21 #include <u-boot/rsa.h>
23 /* Default public exponent for backward compatibility */
24 #define RSA_DEFAULT_PUBEXP 65537
27 * rsa_verify_padding() - Verify RSA message padding is valid
29 * Verify a RSA message's padding is consistent with PKCS1.5
30 * padding as described in the RSA PKCS#1 v2.1 standard.
32 * @msg: Padded message
33 * @pad_len: Number of expected padding bytes
34 * @algo: Checksum algo structure having information on DER encoding etc.
35 * @return 0 on success, != 0 on failure
37 static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
38 struct checksum_algo *algo)
43 /* first byte must be 0x00 */
45 /* second byte must be 0x01 */
47 /* next ff_len bytes must be 0xff */
48 ff_len = pad_len - algo->der_len - 3;
50 ret |= memcmp(msg, msg+1, ff_len-1);
52 /* next byte must be 0x00 */
54 /* next der_len bytes must match der_prefix */
55 ret |= memcmp(msg, algo->der_prefix, algo->der_len);
60 int padding_pkcs_15_verify(struct image_sign_info *info,
61 uint8_t *msg, int msg_len,
62 const uint8_t *hash, int hash_len)
64 struct checksum_algo *checksum = info->checksum;
65 int ret, pad_len = msg_len - checksum->checksum_len;
67 /* Check pkcs1.5 padding bytes. */
68 ret = rsa_verify_padding(msg, pad_len, checksum);
70 debug("In RSAVerify(): Padding check failed!\n");
75 if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) {
76 debug("In RSAVerify(): Hash check failed!\n");
84 * rsa_verify_key() - Verify a signature against some data using RSA Key
86 * Verify a RSA PKCS1.5 signature against an expected hash using
87 * the RSA Key properties in prop structure.
89 * @info: Specifies key and FIT information
90 * @prop: Specifies key
92 * @sig_len: Number of bytes in signature
93 * @hash: Pointer to the expected hash
94 * @key_len: Number of bytes in rsa key
95 * @return 0 if verified, -ve on error
97 static int rsa_verify_key(struct image_sign_info *info,
98 struct key_prop *prop, const uint8_t *sig,
99 const uint32_t sig_len, const uint8_t *hash,
100 const uint32_t key_len)
103 #if !defined(USE_HOSTCC)
104 struct udevice *mod_exp_dev;
106 struct checksum_algo *checksum = info->checksum;
107 struct padding_algo *padding = info->padding;
108 int hash_len = checksum->checksum_len;
110 if (!prop || !sig || !hash || !checksum)
113 if (sig_len != (prop->num_bits / 8)) {
114 debug("Signature is of incorrect length %d\n", sig_len);
118 debug("Checksum algorithm: %s", checksum->name);
120 /* Sanity check for stack size */
121 if (sig_len > RSA_MAX_SIG_BITS / 8) {
122 debug("Signature length %u exceeds maximum %d\n", sig_len,
123 RSA_MAX_SIG_BITS / 8);
127 uint8_t buf[sig_len];
129 #if !defined(USE_HOSTCC)
130 ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
132 printf("RSA: Can't find Modular Exp implementation\n");
136 ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
138 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
141 debug("Error in Modular exponentation\n");
145 ret = padding->verify(info, buf, key_len, hash, hash_len);
147 debug("In RSAVerify(): padding check failed!\n");
155 * rsa_verify_with_keynode() - Verify a signature against some data using
156 * information in node with prperties of RSA Key like modulus, exponent etc.
158 * Parse sign-node and fill a key_prop structure with properties of the
159 * key. Verify a RSA PKCS1.5 signature against an expected hash using
160 * the properties parsed
162 * @info: Specifies key and FIT information
163 * @hash: Pointer to the expected hash
165 * @sig_len: Number of bytes in signature
166 * @node: Node having the RSA Key properties
167 * @return 0 if verified, -ve on error
169 static int rsa_verify_with_keynode(struct image_sign_info *info,
170 const void *hash, uint8_t *sig,
171 uint sig_len, int node)
173 const void *blob = info->fdt_blob;
174 struct key_prop prop;
179 debug("%s: Skipping invalid node", __func__);
183 prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
185 prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
187 prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
188 if (!prop.public_exponent || length < sizeof(uint64_t))
189 prop.public_exponent = NULL;
191 prop.exp_len = sizeof(uint64_t);
193 prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
195 prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
197 if (!prop.num_bits || !prop.modulus) {
198 debug("%s: Missing RSA key info", __func__);
202 ret = rsa_verify_key(info, &prop, sig, sig_len, hash,
203 info->crypto->key_len);
208 int rsa_verify(struct image_sign_info *info,
209 const struct image_region region[], int region_count,
210 uint8_t *sig, uint sig_len)
212 const void *blob = info->fdt_blob;
213 /* Reserve memory for maximum checksum-length */
214 uint8_t hash[info->crypto->key_len];
221 * Verify that the checksum-length does not exceed the
222 * rsa-signature-length
224 if (info->checksum->checksum_len >
225 info->crypto->key_len) {
226 debug("%s: invlaid checksum-algorithm %s for %s\n",
227 __func__, info->checksum->name, info->crypto->name);
231 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
233 debug("%s: No signature node found\n", __func__);
237 /* Calculate checksum with checksum-algorithm */
238 ret = info->checksum->calculate(info->checksum->name,
239 region, region_count, hash);
241 debug("%s: Error in checksum calculation\n", __func__);
245 /* See if we must use a particular key */
246 if (info->required_keynode != -1) {
247 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
248 info->required_keynode);
253 /* Look for a key that matches our hint */
254 snprintf(name, sizeof(name), "key-%s", info->keyname);
255 node = fdt_subnode_offset(blob, sig_node, name);
256 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
260 /* No luck, so try each of the keys in turn */
261 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
262 (noffset >= 0) && (ndepth > 0);
263 noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
264 if (ndepth == 1 && noffset != node) {
265 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,