From b23b5745b5cc4fa9c01cf0fe4a6fe3035d1e91f1 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Mon, 7 Jun 2021 14:34:10 +0100 Subject: [PATCH] PSA RSA PSS: pass pre-hash algorithm to Mbed TLS PSA Crypto always passed MBEDTLS_MD_NONE to Mbed TLS, which worked well as Mbed TLS does not use this parameter for anything beyond determining the input lengths. Some alternative implementations however check the consistency of the algorithm used for pre-hash and for other uses in verification (verify operation and mask generation) and fail if they don't match. This makes all such verifications fail. Furthermore, the PSA Crypto API mandates that the pre-hash and internal uses are aligned as well. Fixes #3990. Signed-off-by: Janos Follath --- library/psa_crypto_rsa.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c index 08db7a428..271b0d519 100644 --- a/library/psa_crypto_rsa.c +++ b/library/psa_crypto_rsa.c @@ -360,27 +360,19 @@ static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg, return( PSA_ERROR_INVALID_ARGUMENT ); #endif -#if defined(BUILTIN_ALG_RSA_PKCS1V15_SIGN) - /* For PKCS#1 v1.5 signature, if using a hash, the hash length - * must be correct. */ - if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) && - alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW ) + /* For signatures using a hash, the hash length must be correct. */ + if( alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW ) { if( md_info == NULL ) return( PSA_ERROR_NOT_SUPPORTED ); if( mbedtls_md_get_size( md_info ) != hash_length ) return( PSA_ERROR_INVALID_ARGUMENT ); } -#endif /* BUILTIN_ALG_RSA_PKCS1V15_SIGN */ - -#if defined(BUILTIN_ALG_RSA_PSS) - /* PSS requires a hash internally. */ - if( PSA_ALG_IS_RSA_PSS( alg ) ) + else { - if( md_info == NULL ) - return( PSA_ERROR_NOT_SUPPORTED ); + if( hash_alg != 0 ) + return( PSA_ERROR_INVALID_ARGUMENT ); } -#endif /* BUILTIN_ALG_RSA_PSS */ return( PSA_SUCCESS ); } @@ -512,7 +504,7 @@ static psa_status_t rsa_verify_hash( mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE, MBEDTLS_RSA_PUBLIC, - MBEDTLS_MD_NONE, + md_alg, (unsigned int) hash_length, hash, signature );