/*
* Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package sun.security.rsa;
import java.util.*;
import java.security.*;
import java.security.spec.*;
import javax.crypto.BadPaddingException;
import javax.crypto.spec.PSource;
import javax.crypto.spec.OAEPParameterSpec;
import sun.security.jca.JCAUtil;
/**
* RSA padding and unpadding.
*
* The various PKCS#1 versions can be found in the EMC/RSA Labs
* web site, which is currently:
*
* http://www.emc.com/emc-plus/rsa-labs/index.htm
*
* or in the IETF RFCs derived from the above PKCS#1 standards.
*
* RFC 2313: v1.5
* RFC 2437: v2.0
* RFC 3447: v2.1
*
* The format of PKCS#1 v1.5 padding is:
*
* 0x00 | BT | PS...PS | 0x00 | data...data
*
* where BT is the blocktype (1 or 2). The length of the entire string
* must be the same as the size of the modulus (i.e. 128 byte for a 1024 bit
* key). Per spec, the padding string must be at least 8 bytes long. That
* leaves up to (length of key in bytes) - 11 bytes for the data.
*
* OAEP padding was introduced in PKCS#1 v2.0 and is a bit more complicated
* and has a number of options. We support:
*
* . arbitrary hash functions ('Hash' in the specification), MessageDigest
* implementation must be available
* . MGF1 as the mask generation function
* . the empty string as the default value for label L and whatever
* specified in javax.crypto.spec.OAEPParameterSpec
*
* The algorithms (representations) are forwards-compatible: that is,
* the algorithm described in previous releases are in later releases.
* However, additional comments/checks/clarifications were added to the
* later versions based on real-world experience (e.g. stricter v1.5
* format checking.)
*
* Note: RSA keys should be at least 512 bits long
*
* @since 1.5
* @author Andreas Sterbenz
*/
public final class RSAPadding {
// NOTE: the constants below are embedded in the JCE RSACipher class
// file. Do not change without coordinating the update
// PKCS#1 v1.5 padding, blocktype 1 (signing)
public static final int PAD_BLOCKTYPE_1 = 1;
// PKCS#1 v1.5 padding, blocktype 2 (encryption)
public static final int PAD_BLOCKTYPE_2 = 2;
// nopadding. Does not do anything, but allows simpler RSACipher code
public static final int PAD_NONE = 3;
// PKCS#1 v2.1 OAEP padding
public static final int PAD_OAEP_MGF1 = 4;
// type, one of PAD_*
private final int type;
// size of the padded block (i.e. size of the modulus)
private final int paddedSize;
// PRNG used to generate padding bytes (PAD_BLOCKTYPE_2, PAD_OAEP_MGF1)
private SecureRandom random;
// maximum size of the data
private final int maxDataSize;
// OAEP: main messagedigest
private MessageDigest md;
// OAEP: message digest for MGF1
private MessageDigest mgfMd;
// OAEP: value of digest of data (user-supplied or zero-length) using md
private byte[] lHash;
/**
* Get a RSAPadding instance of the specified type.
* Keys used with this padding must be paddedSize bytes long.
*/
public static RSAPadding getInstance(int type, int paddedSize)
throws InvalidKeyException, InvalidAlgorithmParameterException {
return new RSAPadding(type, paddedSize, null, null);
}
/**
* Get a RSAPadding instance of the specified type.
* Keys used with this padding must be paddedSize bytes long.
*/
public static RSAPadding getInstance(int type, int paddedSize,
SecureRandom random) throws InvalidKeyException,
InvalidAlgorithmParameterException {
return new RSAPadding(type, paddedSize, random, null);
}
/**
* Get a RSAPadding instance of the specified type, which must be
* OAEP. Keys used with this padding must be paddedSize bytes long.
*/
public static RSAPadding getInstance(int type, int paddedSize,
SecureRandom random, OAEPParameterSpec spec)
throws InvalidKeyException, InvalidAlgorithmParameterException {
return new RSAPadding(type, paddedSize, random, spec);
}
// internal constructor
private RSAPadding(int type, int paddedSize, SecureRandom random,
OAEPParameterSpec spec) throws InvalidKeyException,
InvalidAlgorithmParameterException {
this.type = type;
this.paddedSize = paddedSize;
this.random = random;
if (paddedSize < 64) {
// sanity check, already verified in RSASignature/RSACipher
throw new InvalidKeyException("Padded size must be at least 64");
}
switch (type) {
case PAD_BLOCKTYPE_1:
case PAD_BLOCKTYPE_2:
maxDataSize = paddedSize - 11;
break;
case PAD_NONE:
maxDataSize = paddedSize;
break;
case PAD_OAEP_MGF1:
String mdName = "SHA-1";
String mgfMdName = "SHA-1";
byte[] digestInput = null;
try {
if (spec != null) {
mdName = spec.getDigestAlgorithm();
String mgfName = spec.getMGFAlgorithm();
if (!mgfName.equalsIgnoreCase("MGF1")) {
throw new InvalidAlgorithmParameterException
("Unsupported MGF algo: " + mgfName);
}
mgfMdName = ((MGF1ParameterSpec)spec.getMGFParameters())
.getDigestAlgorithm();
PSource pSrc = spec.getPSource();
String pSrcAlgo = pSrc.getAlgorithm();
if (!pSrcAlgo.equalsIgnoreCase("PSpecified")) {
throw new InvalidAlgorithmParameterException
("Unsupported pSource algo: " + pSrcAlgo);
}
digestInput = ((PSource.PSpecified) pSrc).getValue();
}
md = MessageDigest.getInstance(mdName);
mgfMd = MessageDigest.getInstance(mgfMdName);
} catch (NoSuchAlgorithmException e) {
throw new InvalidKeyException
("Digest " + mdName + " not available", e);
}
lHash = getInitialHash(md, digestInput);
int digestLen = lHash.length;
maxDataSize = paddedSize - 2 - 2 * digestLen;
if (maxDataSize <= 0) {
throw new InvalidKeyException
("Key is too short for encryption using OAEPPadding" +
" with " + mdName + " and MGF1" + mgfMdName);
}
break;
default:
throw new InvalidKeyException("Invalid padding: " + type);
}
}
// cache of hashes of zero length data
private static final Map<String,byte[]> emptyHashes =
Collections.synchronizedMap(new HashMap<String,byte[]>());
/**
* Return the value of the digest using the specified message digest
* <code>md</code> and the digest input <code>digestInput</code>.
* if <code>digestInput</code> is null or 0-length, zero length
* is used to generate the initial digest.
* Note: the md object must be in reset state
*/
private static byte[] getInitialHash(MessageDigest md,
byte[] digestInput) {
byte[] result;
if ((digestInput == null) || (digestInput.length == 0)) {
String digestName = md.getAlgorithm();
result = emptyHashes.get(digestName);
if (result == null) {
result = md.digest();
emptyHashes.put(digestName, result);
}
} else {
result = md.digest(digestInput);
}
return result;
}
/**
* Return the maximum size of the plaintext data that can be processed
* using this object.
*/
public int getMaxDataSize() {
return maxDataSize;
}
/**
* Pad the data and return the padded block.
*/
public byte[] pad(byte[] data, int ofs, int len)
throws BadPaddingException {
return pad(RSACore.convert(data, ofs, len));
}
/**
* Pad the data and return the padded block.
*/
public byte[] pad(byte[] data) throws BadPaddingException {
if (data.length > maxDataSize) {
throw new BadPaddingException("Data must be shorter than "
+ (maxDataSize + 1) + " bytes but received "
+ data.length + " bytes.");
}
switch (type) {
case PAD_NONE:
return data;
case PAD_BLOCKTYPE_1:
case PAD_BLOCKTYPE_2:
return padV15(data);
case PAD_OAEP_MGF1:
return padOAEP(data);
default:
throw new AssertionError();
}
}
/**
* Unpad the padded block and return the data.
*/
public byte[] unpad(byte[] padded, int ofs, int len)
throws BadPaddingException {
return unpad(RSACore.convert(padded, ofs, len));
}
/**
* Unpad the padded block and return the data.
*/
public byte[] unpad(byte[] padded) throws BadPaddingException {
if (padded.length != paddedSize) {
throw new BadPaddingException("Decryption error." +
"The padded array length (" + padded.length +
") is not the specified padded size (" + paddedSize + ")");
}
switch (type) {
case PAD_NONE:
return padded;
case PAD_BLOCKTYPE_1:
case PAD_BLOCKTYPE_2:
return unpadV15(padded);
case PAD_OAEP_MGF1:
return unpadOAEP(padded);
default:
throw new AssertionError();
}
}
/**
* PKCS#1 v1.5 padding (blocktype 1 and 2).
*/
private byte[] padV15(byte[] data) throws BadPaddingException {
byte[] padded = new byte[paddedSize];
System.arraycopy(data, 0, padded, paddedSize - data.length,
data.length);
int psSize = paddedSize - 3 - data.length;
int k = 0;
padded[k++] = 0;
padded[k++] = (byte)type;
if (type == PAD_BLOCKTYPE_1) {
// blocktype 1: all padding bytes are 0xff
while (psSize-- > 0) {
padded[k++] = (byte)0xff;
}
} else {
// blocktype 2: padding bytes are random non-zero bytes
if (random == null) {
random = JCAUtil.getSecureRandom();
}
// generate non-zero padding bytes
// use a buffer to reduce calls to SecureRandom
while (psSize > 0) {
// extra bytes to avoid zero bytes,
// number of zero bytes <= 4 in 98% cases
byte[] r = new byte[psSize + 4];
random.nextBytes(r);
for (int i = 0; i < r.length && psSize > 0; i++) {
if (r[i] != 0) {
padded[k++] = r[i];
psSize--;
}
}
}
}
return padded;
}
/**
* PKCS#1 v1.5 unpadding (blocktype 1 (signature) and 2 (encryption)).
*
* Note that we want to make it a constant-time operation
*/
private byte[] unpadV15(byte[] padded) throws BadPaddingException {
int k = 0;
boolean bp = false;
if (padded[k++] != 0) {
bp = true;
}
if (padded[k++] != type) {
bp = true;
}
int p = 0;
while (k < padded.length) {
int b = padded[k++] & 0xff;
if ((b == 0) && (p == 0)) {
p = k;
}
if ((k == padded.length) && (p == 0)) {
bp = true;
}
if ((type == PAD_BLOCKTYPE_1) && (b != 0xff) &&
(p == 0)) {
bp = true;
}
}
int n = padded.length - p;
if (n > maxDataSize) {
bp = true;
}
// copy useless padding array for a constant-time method
byte[] padding = new byte[p];
System.arraycopy(padded, 0, padding, 0, p);
byte[] data = new byte[n];
System.arraycopy(padded, p, data, 0, n);
BadPaddingException bpe = new BadPaddingException("Decryption error");
if (bp) {
throw bpe;
} else {
return data;
}
}
/**
* PKCS#1 v2.0 OAEP padding (MGF1).
* Paragraph references refer to PKCS#1 v2.1 (June 14, 2002)
*/
private byte[] padOAEP(byte[] M) throws BadPaddingException {
if (random == null) {
random = JCAUtil.getSecureRandom();
}
int hLen = lHash.length;
// 2.d: generate a random octet string seed of length hLen
// if necessary
byte[] seed = new byte[hLen];
random.nextBytes(seed);
// buffer for encoded message EM
byte[] EM = new byte[paddedSize];
// start and length of seed (as index into EM)
int seedStart = 1;
int seedLen = hLen;
// copy seed into EM
System.arraycopy(seed, 0, EM, seedStart, seedLen);
// start and length of data block DB in EM
// we place it inside of EM to reduce copying
int dbStart = hLen + 1;
int dbLen = EM.length - dbStart;
// start of message M in EM
int mStart = paddedSize - M.length;
// build DB
// 2.b: Concatenate lHash, PS, a single octet with hexadecimal value
// 0x01, and the message M to form a data block DB of length
// k - hLen -1 octets as DB = lHash || PS || 0x01 || M
// (note that PS is all zeros)
System.arraycopy(lHash, 0, EM, dbStart, hLen);
EM[mStart - 1] = 1;
System.arraycopy(M, 0, EM, mStart, M.length);
// produce maskedDB
mgf1(EM, seedStart, seedLen, EM, dbStart, dbLen);
// produce maskSeed
mgf1(EM, dbStart, dbLen, EM, seedStart, seedLen);
return EM;
}
/**
* PKCS#1 v2.1 OAEP unpadding (MGF1).
*/
private byte[] unpadOAEP(byte[] padded) throws BadPaddingException {
byte[] EM = padded;
boolean bp = false;
int hLen = lHash.length;
if (EM[0] != 0) {
bp = true;
}
int seedStart = 1;
int seedLen = hLen;
int dbStart = hLen + 1;
int dbLen = EM.length - dbStart;
mgf1(EM, dbStart, dbLen, EM, seedStart, seedLen);
mgf1(EM, seedStart, seedLen, EM, dbStart, dbLen);
// verify lHash == lHash'
for (int i = 0; i < hLen; i++) {
if (lHash[i] != EM[dbStart + i]) {
bp = true;
}
}
int padStart = dbStart + hLen;
int onePos = -1;
for (int i = padStart; i < EM.length; i++) {
int value = EM[i];
if (onePos == -1) {
if (value == 0x00) {
// continue;
} else if (value == 0x01) {
onePos = i;
} else { // Anything other than {0,1} is bad.
bp = true;
}
}
}
// We either ran off the rails or found something other than 0/1.
if (onePos == -1) {
bp = true;
onePos = EM.length - 1; // Don't inadvertently return any data.
}
int mStart = onePos + 1;
// copy useless padding array for a constant-time method
byte [] tmp = new byte[mStart - padStart];
System.arraycopy(EM, padStart, tmp, 0, tmp.length);
byte [] m = new byte[EM.length - mStart];
System.arraycopy(EM, mStart, m, 0, m.length);
BadPaddingException bpe = new BadPaddingException("Decryption error");
if (bp) {
throw bpe;
} else {
return m;
}
}
/**
* Compute MGF1 using mgfMD as the message digest.
* Note that we combine MGF1 with the XOR operation to reduce data
* copying.
*
* We generate maskLen bytes of MGF1 from the seed and XOR it into
* out[] starting at outOfs;
*/
private void mgf1(byte[] seed, int seedOfs, int seedLen,
byte[] out, int outOfs, int maskLen) throws BadPaddingException {
byte[] C = new byte[4]; // 32 bit counter
byte[] digest = new byte[mgfMd.getDigestLength()];
while (maskLen > 0) {
mgfMd.update(seed, seedOfs, seedLen);
mgfMd.update(C);
try {
mgfMd.digest(digest, 0, digest.length);
} catch (DigestException e) {
// should never happen
throw new BadPaddingException(e.toString());
}
for (int i = 0; (i < digest.length) && (maskLen > 0); maskLen--) {
out[outOfs++] ^= digest[i++];
}
if (maskLen > 0) {
// increment counter
for (int i = C.length - 1; (++C[i] == 0) && (i > 0); i--) {
// empty
}
}
}
}
}