blob: 61dc4c2e706037ab6071d0142af00953a5b97806 [file] [log] [blame]
Simon Glass19c402a2013-06-13 15:10:02 -07001/*
2 * Copyright (c) 2013, Google Inc.
3 *
Wolfgang Denk1a459662013-07-08 09:37:19 +02004 * SPDX-License-Identifier: GPL-2.0+
Simon Glass19c402a2013-06-13 15:10:02 -07005 */
6
Heiko Schocher29a23f92014-03-03 12:19:30 +01007#ifndef USE_HOSTCC
Simon Glass19c402a2013-06-13 15:10:02 -07008#include <common.h>
9#include <fdtdec.h>
Heiko Schocher29a23f92014-03-03 12:19:30 +010010#include <asm/types.h>
11#include <asm/byteorder.h>
Masahiro Yamada1221ce42016-09-21 11:28:55 +090012#include <linux/errno.h>
Heiko Schocher29a23f92014-03-03 12:19:30 +010013#include <asm/types.h>
14#include <asm/unaligned.h>
Ruchika Guptac937ff62015-01-23 16:01:54 +053015#include <dm.h>
Heiko Schocher29a23f92014-03-03 12:19:30 +010016#else
17#include "fdt_host.h"
18#include "mkimage.h"
19#include <fdt_support.h>
20#endif
Ruchika Guptafc2f4242015-01-23 16:01:50 +053021#include <u-boot/rsa-mod-exp.h>
Jeroen Hofstee2b9912e2014-06-12 22:27:12 +020022#include <u-boot/rsa.h>
Heiko Schocher29a23f92014-03-03 12:19:30 +010023
Michael van der Westhuizene0f2f152014-07-02 10:17:26 +020024/* Default public exponent for backward compatibility */
25#define RSA_DEFAULT_PUBEXP 65537
26
Simon Glass19c402a2013-06-13 15:10:02 -070027/**
Andrew Dudada29f292016-11-08 18:53:40 +000028 * rsa_verify_padding() - Verify RSA message padding is valid
29 *
30 * Verify a RSA message's padding is consistent with PKCS1.5
31 * padding as described in the RSA PKCS#1 v2.1 standard.
32 *
33 * @msg: Padded message
34 * @pad_len: Number of expected padding bytes
35 * @algo: Checksum algo structure having information on DER encoding etc.
36 * @return 0 on success, != 0 on failure
37 */
38static int rsa_verify_padding(const uint8_t *msg, const int pad_len,
39 struct checksum_algo *algo)
40{
41 int ff_len;
42 int ret;
43
44 /* first byte must be 0x00 */
45 ret = *msg++;
46 /* second byte must be 0x01 */
47 ret |= *msg++ ^ 0x01;
48 /* next ff_len bytes must be 0xff */
49 ff_len = pad_len - algo->der_len - 3;
50 ret |= *msg ^ 0xff;
51 ret |= memcmp(msg, msg+1, ff_len-1);
52 msg += ff_len;
53 /* next byte must be 0x00 */
54 ret |= *msg++;
55 /* next der_len bytes must match der_prefix */
56 ret |= memcmp(msg, algo->der_prefix, algo->der_len);
57
58 return ret;
59}
60
61/**
Ruchika Guptafc2f4242015-01-23 16:01:50 +053062 * rsa_verify_key() - Verify a signature against some data using RSA Key
Simon Glass19c402a2013-06-13 15:10:02 -070063 *
Ruchika Guptafc2f4242015-01-23 16:01:50 +053064 * Verify a RSA PKCS1.5 signature against an expected hash using
65 * the RSA Key properties in prop structure.
66 *
67 * @prop: Specifies key
68 * @sig: Signature
69 * @sig_len: Number of bytes in signature
70 * @hash: Pointer to the expected hash
Andrew Duda0c1d74f2016-11-08 18:53:41 +000071 * @key_len: Number of bytes in rsa key
72 * @algo: Checksum algo structure having information on DER encoding etc.
Ruchika Guptafc2f4242015-01-23 16:01:50 +053073 * @return 0 if verified, -ve on error
Simon Glass19c402a2013-06-13 15:10:02 -070074 */
Ruchika Guptafc2f4242015-01-23 16:01:50 +053075static int rsa_verify_key(struct key_prop *prop, const uint8_t *sig,
Heiko Schocher646257d2014-03-03 12:19:26 +010076 const uint32_t sig_len, const uint8_t *hash,
Andrew Duda0c1d74f2016-11-08 18:53:41 +000077 const uint32_t key_len, struct checksum_algo *algo)
Simon Glass19c402a2013-06-13 15:10:02 -070078{
Simon Glass19c402a2013-06-13 15:10:02 -070079 int pad_len;
80 int ret;
Ruchika Guptac937ff62015-01-23 16:01:54 +053081#if !defined(USE_HOSTCC)
82 struct udevice *mod_exp_dev;
83#endif
Simon Glass19c402a2013-06-13 15:10:02 -070084
Ruchika Guptafc2f4242015-01-23 16:01:50 +053085 if (!prop || !sig || !hash || !algo)
Simon Glass19c402a2013-06-13 15:10:02 -070086 return -EIO;
87
Ruchika Guptafc2f4242015-01-23 16:01:50 +053088 if (sig_len != (prop->num_bits / 8)) {
Simon Glass19c402a2013-06-13 15:10:02 -070089 debug("Signature is of incorrect length %d\n", sig_len);
90 return -EINVAL;
91 }
92
Heiko Schocher646257d2014-03-03 12:19:26 +010093 debug("Checksum algorithm: %s", algo->name);
94
Simon Glass19c402a2013-06-13 15:10:02 -070095 /* Sanity check for stack size */
96 if (sig_len > RSA_MAX_SIG_BITS / 8) {
97 debug("Signature length %u exceeds maximum %d\n", sig_len,
98 RSA_MAX_SIG_BITS / 8);
99 return -EINVAL;
100 }
101
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530102 uint8_t buf[sig_len];
Simon Glass19c402a2013-06-13 15:10:02 -0700103
Ruchika Guptac937ff62015-01-23 16:01:54 +0530104#if !defined(USE_HOSTCC)
105 ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev);
106 if (ret) {
107 printf("RSA: Can't find Modular Exp implementation\n");
108 return -EINVAL;
109 }
110
111 ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf);
112#else
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530113 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf);
Ruchika Guptac937ff62015-01-23 16:01:54 +0530114#endif
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530115 if (ret) {
116 debug("Error in Modular exponentation\n");
Simon Glass19c402a2013-06-13 15:10:02 -0700117 return ret;
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530118 }
Simon Glass19c402a2013-06-13 15:10:02 -0700119
Andrew Duda0c1d74f2016-11-08 18:53:41 +0000120 pad_len = key_len - algo->checksum_len;
Simon Glass19c402a2013-06-13 15:10:02 -0700121
122 /* Check pkcs1.5 padding bytes. */
Andrew Dudada29f292016-11-08 18:53:40 +0000123 ret = rsa_verify_padding(buf, pad_len, algo);
124 if (ret) {
Simon Glass19c402a2013-06-13 15:10:02 -0700125 debug("In RSAVerify(): Padding check failed!\n");
126 return -EINVAL;
127 }
128
129 /* Check hash. */
130 if (memcmp((uint8_t *)buf + pad_len, hash, sig_len - pad_len)) {
131 debug("In RSAVerify(): Hash check failed!\n");
132 return -EACCES;
133 }
134
135 return 0;
136}
137
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530138/**
139 * rsa_verify_with_keynode() - Verify a signature against some data using
140 * information in node with prperties of RSA Key like modulus, exponent etc.
141 *
142 * Parse sign-node and fill a key_prop structure with properties of the
143 * key. Verify a RSA PKCS1.5 signature against an expected hash using
144 * the properties parsed
145 *
146 * @info: Specifies key and FIT information
147 * @hash: Pointer to the expected hash
148 * @sig: Signature
149 * @sig_len: Number of bytes in signature
150 * @node: Node having the RSA Key properties
151 * @return 0 if verified, -ve on error
152 */
Simon Glass19c402a2013-06-13 15:10:02 -0700153static int rsa_verify_with_keynode(struct image_sign_info *info,
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530154 const void *hash, uint8_t *sig,
155 uint sig_len, int node)
Simon Glass19c402a2013-06-13 15:10:02 -0700156{
157 const void *blob = info->fdt_blob;
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530158 struct key_prop prop;
Michael van der Westhuizene0f2f152014-07-02 10:17:26 +0200159 int length;
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530160 int ret = 0;
Simon Glass19c402a2013-06-13 15:10:02 -0700161
162 if (node < 0) {
163 debug("%s: Skipping invalid node", __func__);
164 return -EBADF;
165 }
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530166
167 prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0);
168
169 prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0);
170
171 prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length);
172 if (!prop.public_exponent || length < sizeof(uint64_t))
173 prop.public_exponent = NULL;
174
175 prop.exp_len = sizeof(uint64_t);
176
177 prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL);
178
179 prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL);
180
181 if (!prop.num_bits || !prop.modulus) {
Simon Glass19c402a2013-06-13 15:10:02 -0700182 debug("%s: Missing RSA key info", __func__);
183 return -EFAULT;
184 }
185
Andrew Duda0c1d74f2016-11-08 18:53:41 +0000186 ret = rsa_verify_key(&prop, sig, sig_len, hash,
187 info->algo->crypto->key_len,
188 info->algo->checksum);
Simon Glass19c402a2013-06-13 15:10:02 -0700189
Ruchika Guptafc2f4242015-01-23 16:01:50 +0530190 return ret;
Simon Glass19c402a2013-06-13 15:10:02 -0700191}
192
193int rsa_verify(struct image_sign_info *info,
194 const struct image_region region[], int region_count,
195 uint8_t *sig, uint sig_len)
196{
197 const void *blob = info->fdt_blob;
Heiko Schocher646257d2014-03-03 12:19:26 +0100198 /* Reserve memory for maximum checksum-length */
Andrew Duda0c1d74f2016-11-08 18:53:41 +0000199 uint8_t hash[info->algo->crypto->key_len];
Simon Glass19c402a2013-06-13 15:10:02 -0700200 int ndepth, noffset;
201 int sig_node, node;
202 char name[100];
Heiko Schocher646257d2014-03-03 12:19:26 +0100203 int ret;
204
205 /*
206 * Verify that the checksum-length does not exceed the
207 * rsa-signature-length
208 */
Heiko Schocherdb1b5f32014-03-03 12:19:27 +0100209 if (info->algo->checksum->checksum_len >
Andrew Duda0c1d74f2016-11-08 18:53:41 +0000210 info->algo->crypto->key_len) {
Heiko Schocherdb1b5f32014-03-03 12:19:27 +0100211 debug("%s: invlaid checksum-algorithm %s for %s\n",
Andrew Duda0c1d74f2016-11-08 18:53:41 +0000212 __func__, info->algo->checksum->name,
213 info->algo->crypto->name);
Heiko Schocher646257d2014-03-03 12:19:26 +0100214 return -EINVAL;
215 }
Simon Glass19c402a2013-06-13 15:10:02 -0700216
217 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME);
218 if (sig_node < 0) {
219 debug("%s: No signature node found\n", __func__);
220 return -ENOENT;
221 }
222
Heiko Schocher646257d2014-03-03 12:19:26 +0100223 /* Calculate checksum with checksum-algorithm */
Ruchika Guptab37b46f2015-01-23 16:01:59 +0530224 ret = info->algo->checksum->calculate(info->algo->checksum->name,
225 region, region_count, hash);
226 if (ret < 0) {
227 debug("%s: Error in checksum calculation\n", __func__);
228 return -EINVAL;
229 }
Simon Glass19c402a2013-06-13 15:10:02 -0700230
231 /* See if we must use a particular key */
232 if (info->required_keynode != -1) {
233 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
234 info->required_keynode);
235 if (!ret)
236 return ret;
237 }
238
239 /* Look for a key that matches our hint */
240 snprintf(name, sizeof(name), "key-%s", info->keyname);
241 node = fdt_subnode_offset(blob, sig_node, name);
242 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node);
243 if (!ret)
244 return ret;
245
246 /* No luck, so try each of the keys in turn */
247 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth);
248 (noffset >= 0) && (ndepth > 0);
249 noffset = fdt_next_node(info->fit, noffset, &ndepth)) {
250 if (ndepth == 1 && noffset != node) {
251 ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
252 noffset);
253 if (!ret)
254 break;
255 }
256 }
257
258 return ret;
259}