diff options
author | Russ Cox <rsc@golang.org> | 2017-09-06 23:31:41 -0400 |
---|---|---|
committer | Russ Cox <rsc@golang.org> | 2017-09-22 20:08:03 +0000 |
commit | eb32dbc4f6dcb8e618f2de2576e4dd5d41e94642 (patch) | |
tree | fe55dd01e98c86a033ea140057fd7d5f5f146fb9 | |
parent | 11e083e44b315d3135fbd11691b34fb4ac1377fb (diff) | |
download | go-eb32dbc4f6dcb8e618f2de2576e4dd5d41e94642.tar.gz go-eb32dbc4f6dcb8e618f2de2576e4dd5d41e94642.zip |
[dev.boringcrypto.go1.8] crypto/internal/boring: handle RSA verification of short signatures
The standard Go crypto/rsa allows signatures to be shorter
than the RSA modulus and assumes leading zeros.
BoringCrypto does not, so supply the leading zeros explicitly.
This fixes the golang.org/x/crypto/openpgp tests.
Change-Id: Ic8b18d6beb0e02992a0474f5fdb2b73ccf7098cf
Reviewed-on: https://go-review.googlesource.com/62170
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-on: https://go-review.googlesource.com/65480
Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
-rw-r--r-- | src/crypto/internal/boring/rsa.go | 9 | ||||
-rw-r--r-- | src/crypto/rsa/boring_test.go | 27 |
2 files changed, 35 insertions, 1 deletions
diff --git a/src/crypto/internal/boring/rsa.go b/src/crypto/internal/boring/rsa.go index 0066520bf3..c31554de0c 100644 --- a/src/crypto/internal/boring/rsa.go +++ b/src/crypto/internal/boring/rsa.go @@ -283,9 +283,16 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte) ([]byte, } func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte) error { + size := int(C._goboringcrypto_RSA_size(pub.key)) + if len(sig) < size { + // BoringCrypto requires sig to be same size as RSA key, so pad with leading zeros. + zsig := make([]byte, size) + copy(zsig[len(zsig)-len(sig):], sig) + sig = zsig + } if h == 0 { var outLen C.size_t - out := make([]byte, C._goboringcrypto_RSA_size(pub.key)) + out := make([]byte, size) if C._goboringcrypto_RSA_verify_raw(pub.key, &outLen, base(out), C.size_t(len(out)), base(sig), C.size_t(len(sig)), C.GO_RSA_PKCS1_PADDING) == 0 { return fail("RSA_verify") } diff --git a/src/crypto/rsa/boring_test.go b/src/crypto/rsa/boring_test.go index 7fbafee16e..290fe10a79 100644 --- a/src/crypto/rsa/boring_test.go +++ b/src/crypto/rsa/boring_test.go @@ -5,6 +5,7 @@ package rsa import ( + "crypto" "crypto/rand" "encoding/asn1" "reflect" @@ -38,3 +39,29 @@ func TestBoringDeepEqual(t *testing.T) { t.Fatalf("DeepEqual compared boring fields") } } + +func TestBoringVerify(t *testing.T) { + // This changed behavior and broke golang.org/x/crypto/openpgp. + // Go accepts signatures without leading 0 padding, while BoringCrypto does not. + // So the Go wrappers must adapt. + key := &PublicKey{ + N: bigFromHex("c4fdf7b40a5477f206e6ee278eaef888ca73bf9128a9eef9f2f1ddb8b7b71a4c07cfa241f028a04edb405e4d916c61d6beabc333813dc7b484d2b3c52ee233c6a79b1eea4e9cc51596ba9cd5ac5aeb9df62d86ea051055b79d03f8a4fa9f38386f5bd17529138f3325d46801514ea9047977e0829ed728e68636802796801be1"), + E: 65537, + } + + hash := fromHex("019c5571724fb5d0e47a4260c940e9803ba05a44") + paddedHash := fromHex("3021300906052b0e03021a05000414019c5571724fb5d0e47a4260c940e9803ba05a44") + + // signature is one byte shorter than key.N. + sig := fromHex("5edfbeb6a73e7225ad3cc52724e2872e04260d7daf0d693c170d8c4b243b8767bc7785763533febc62ec2600c30603c433c095453ede59ff2fcabeb84ce32e0ed9d5cf15ffcbc816202b64370d4d77c1e9077d74e94a16fb4fa2e5bec23a56d7a73cf275f91691ae1801a976fcde09e981a2f6327ac27ea1fecf3185df0d56") + + err := VerifyPKCS1v15(key, 0, paddedHash, sig) + if err != nil { + t.Errorf("raw: %v", err) + } + + err = VerifyPKCS1v15(key, crypto.SHA1, hash, sig) + if err != nil { + t.Errorf("sha1: %v", err) + } +} |