2 * Copyright (c) 2013, Google Inc.
4 * SPDX-License-Identifier: GPL-2.0+
10 #include <asm/types.h>
11 #include <asm/byteorder.h>
12 #include <asm/errno.h>
13 #include <asm/types.h>
14 #include <asm/unaligned.h>
18 #include <fdt_support.h>
20 #include <u-boot/rsa-mod-exp.h>
21 #include <u-boot/rsa.h>
23 /* Default public exponent for backward compatibility */
24 #define RSA_DEFAULT_PUBEXP 65537
27 * rsa_verify_key() - Verify a signature against some data using RSA Key
29 * Verify a RSA PKCS1.5 signature against an expected hash using
30 * the RSA Key properties in prop structure.
32 * @prop: Specifies key
34 * @sig_len: Number of bytes in signature
35 * @hash: Pointer to the expected hash
36 * @algo: Checksum algo structure having information on RSA padding etc.
37 * @return 0 if verified, -ve on error
39 static int rsa_verify_key(struct key_prop *prop, const uint8_t *sig,
40 const uint32_t sig_len, const uint8_t *hash,
41 struct checksum_algo *algo)
43 const uint8_t *padding;
47 if (!prop || !sig || !hash || !algo)
50 if (sig_len != (prop->num_bits / 8)) {
51 debug("Signature is of incorrect length %d\n", sig_len);
55 debug("Checksum algorithm: %s", algo->name);
57 /* Sanity check for stack size */
58 if (sig_len > RSA_MAX_SIG_BITS / 8) {
59 debug("Signature length %u exceeds maximum %d\n", sig_len,
60 RSA_MAX_SIG_BITS / 8);
66 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
68 debug("Error in Modular exponentation\n");
72 padding = algo->rsa_padding;
73 pad_len = algo->pad_len - algo->checksum_len;
75 /* Check pkcs1.5 padding bytes. */
76 if (memcmp(buf, padding, pad_len)) {
77 debug("In RSAVerify(): Padding check failed!\n");
82 if (memcmp((uint8_t *)buf + pad_len, hash, sig_len - pad_len)) {
83 debug("In RSAVerify(): Hash check failed!\n");
91 * rsa_verify_with_keynode() - Verify a signature against some data using
92 * information in node with prperties of RSA Key like modulus, exponent etc.
94 * Parse sign-node and fill a key_prop structure with properties of the
95 * key. Verify a RSA PKCS1.5 signature against an expected hash using
96 * the properties parsed
98 * @info: Specifies key and FIT information
99 * @hash: Pointer to the expected hash
101 * @sig_len: Number of bytes in signature
102 * @node: Node having the RSA Key properties
103 * @return 0 if verified, -ve on error
105 static int rsa_verify_with_keynode(struct image_sign_info *info,
106 const void *hash, uint8_t *sig,
107 uint sig_len, int node)
109 const void *blob = info->fdt_blob;
110 struct key_prop prop;
115 debug("%s: Skipping invalid node", __func__);
119 prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
121 prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
123 prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
124 if (!prop.public_exponent || length < sizeof(uint64_t))
125 prop.public_exponent = NULL;
127 prop.exp_len = sizeof(uint64_t);
129 prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
131 prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
133 if (!prop.num_bits || !prop.modulus) {
134 debug("%s: Missing RSA key info", __func__);
138 ret = rsa_verify_key(&prop, sig, sig_len, hash, info->algo->checksum);
143 int rsa_verify(struct image_sign_info *info,
144 const struct image_region region[], int region_count,
145 uint8_t *sig, uint sig_len)
147 const void *blob = info->fdt_blob;
148 /* Reserve memory for maximum checksum-length */
149 uint8_t hash[info->algo->checksum->pad_len];
156 * Verify that the checksum-length does not exceed the
157 * rsa-signature-length
159 if (info->algo->checksum->checksum_len >
160 info->algo->checksum->pad_len) {
161 debug("%s: invlaid checksum-algorithm %s for %s\n",
162 __func__, info->algo->checksum->name, info->algo->name);
166 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
168 debug("%s: No signature node found\n", __func__);
172 /* Calculate checksum with checksum-algorithm */
173 info->algo->checksum->calculate(region, region_count, hash);
175 /* See if we must use a particular key */
176 if (info->required_keynode != -1) {
177 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
178 info->required_keynode);
183 /* Look for a key that matches our hint */
184 snprintf(name, sizeof(name), "key-%s", info->keyname);
185 node = fdt_subnode_offset(blob, sig_node, name);
186 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
190 /* No luck, so try each of the keys in turn */
191 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
192 (noffset >= 0) && (ndepth > 0);
193 noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
194 if (ndepth == 1 && noffset != node) {
195 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,