1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
6 * The library is free for all purposes without any express
12 @file pkcs_1_pss_encode.c
13 PKCS #1 PSS Signature Padding, Tom St Denis
19 PKCS #1 v2.00 Signature Encoding
20 @param msghash The hash to encode
21 @param msghashlen The length of the hash (octets)
22 @param saltlen The length of the salt desired (octets)
23 @param prng An active PRNG context
24 @param prng_idx The index of the PRNG desired
25 @param hash_idx The index of the hash desired
26 @param modulus_bitlen The bit length of the RSA modulus
27 @param out [out] The destination of the encoding
28 @param outlen [in/out] The max size and resulting size of the encoded data
29 @return CRYPT_OK if successful
31 int pkcs_1_pss_encode(const unsigned char *msghash, unsigned long msghashlen,
32 unsigned long saltlen, prng_state *prng,
33 int prng_idx, int hash_idx,
34 unsigned long modulus_bitlen,
35 unsigned char *out, unsigned long *outlen)
37 unsigned char *DB, *mask, *salt, *hash;
38 unsigned long x, y, hLen, modulus_len;
42 LTC_ARGCHK(msghash != NULL);
43 LTC_ARGCHK(out != NULL);
44 LTC_ARGCHK(outlen != NULL);
46 /* ensure hash and PRNG are valid */
47 if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
50 if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
54 hLen = hash_descriptor[hash_idx].hashsize;
56 modulus_len = (modulus_bitlen>>3) + (modulus_bitlen & 7 ? 1 : 0);
59 if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2)) {
60 return CRYPT_PK_INVALID_SIZE;
63 /* allocate ram for DB/mask/salt/hash of size modulus_len */
64 DB = XMALLOC(modulus_len);
65 mask = XMALLOC(modulus_len);
66 salt = XMALLOC(modulus_len);
67 hash = XMALLOC(modulus_len);
68 if (DB == NULL || mask == NULL || salt == NULL || hash == NULL) {
85 /* generate random salt */
87 if (prng_descriptor[prng_idx].read(salt, saltlen, prng) != saltlen) {
88 err = CRYPT_ERROR_READPRNG;
93 /* M = (eight) 0x00 || msghash || salt, hash = H(M) */
94 if ((err = hash_descriptor[hash_idx].init(&md)) != CRYPT_OK) {
98 if ((err = hash_descriptor[hash_idx].process(&md, DB, 8)) != CRYPT_OK) {
101 if ((err = hash_descriptor[hash_idx].process(&md, msghash, msghashlen)) != CRYPT_OK) {
104 if ((err = hash_descriptor[hash_idx].process(&md, salt, saltlen)) != CRYPT_OK) {
107 if ((err = hash_descriptor[hash_idx].done(&md, hash)) != CRYPT_OK) {
111 /* generate DB = PS || 0x01 || salt, PS == modulus_len - saltlen - hLen - 2 zero bytes */
113 XMEMSET(DB + x, 0, modulus_len - saltlen - hLen - 2);
114 x += modulus_len - saltlen - hLen - 2;
116 XMEMCPY(DB + x, salt, saltlen);
119 /* generate mask of length modulus_len - hLen - 1 from hash */
120 if ((err = pkcs_1_mgf1(hash_idx, hash, hLen, mask, modulus_len - hLen - 1)) != CRYPT_OK) {
125 for (y = 0; y < (modulus_len - hLen - 1); y++) {
129 /* output is DB || hash || 0xBC */
130 if (*outlen < modulus_len) {
131 *outlen = modulus_len;
132 err = CRYPT_BUFFER_OVERFLOW;
136 /* DB len = modulus_len - hLen - 1 */
138 XMEMCPY(out + y, DB, modulus_len - hLen - 1);
139 y += modulus_len - hLen - 1;
142 XMEMCPY(out + y, hash, hLen);
148 /* now clear the 8*modulus_len - modulus_bitlen most significant bits */
149 out[0] &= 0xFF >> ((modulus_len<<3) - modulus_bitlen);
151 /* store output size */
152 *outlen = modulus_len;
155 #ifdef LTC_CLEAN_STACK
156 zeromem(DB, modulus_len);
157 zeromem(mask, modulus_len);
158 zeromem(salt, modulus_len);
159 zeromem(hash, modulus_len);
170 #endif /* LTC_PKCS_1 */
172 /* ref: $Format:%D$ */
173 /* git commit: $Format:%H$ */
174 /* commit time: $Format:%ai$ */