Skip to content

Commit eb32dbc

Browse files
rscrsc
committed
[dev.boringcrypto.go1.8] crypto/internal/boring: handle RSA verification of short signatures
The standard Go crypto/rsa allows signatures to be shorter than the RSA modulus and assumes leading zeros. BoringCrypto does not, so supply the leading zeros explicitly. This fixes the golang.org/x/crypto/openpgp tests. Change-Id: Ic8b18d6beb0e02992a0474f5fdb2b73ccf7098cf Reviewed-on: https://go-review.googlesource.com/62170 Reviewed-by: Adam Langley <[email protected]> Reviewed-on: https://go-review.googlesource.com/65480 Run-TryBot: Russ Cox <[email protected]> Reviewed-by: Russ Cox <[email protected]>
1 parent 11e083e commit eb32dbc

2 files changed

Lines changed: 35 additions & 1 deletion

File tree

‎src/crypto/internal/boring/rsa.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,9 +283,16 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte) ([]byte,
283283
}
284284

285285
func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte) error {
286+
size := int(C._goboringcrypto_RSA_size(pub.key))
287+
if len(sig) < size {
288+
// BoringCrypto requires sig to be same size as RSA key, so pad with leading zeros.
289+
zsig := make([]byte, size)
290+
copy(zsig[len(zsig)-len(sig):], sig)
291+
sig = zsig
292+
}
286293
if h == 0 {
287294
var outLen C.size_t
288-
out := make([]byte, C._goboringcrypto_RSA_size(pub.key))
295+
out := make([]byte, size)
289296
if C._goboringcrypto_RSA_verify_raw(pub.key, &outLen, base(out), C.size_t(len(out)), base(sig), C.size_t(len(sig)), C.GO_RSA_PKCS1_PADDING) == 0 {
290297
return fail("RSA_verify")
291298
}

‎src/crypto/rsa/boring_test.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
package rsa
66

77
import (
8+
"crypto"
89
"crypto/rand"
910
"encoding/asn1"
1011
"reflect"
@@ -38,3 +39,29 @@ func TestBoringDeepEqual(t *testing.T) {
3839
t.Fatalf("DeepEqual compared boring fields")
3940
}
4041
}
42+
43+
func TestBoringVerify(t *testing.T) {
44+
// This changed behavior and broke golang.org/x/crypto/openpgp.
45+
// Go accepts signatures without leading 0 padding, while BoringCrypto does not.
46+
// So the Go wrappers must adapt.
47+
key := &PublicKey{
48+
N: bigFromHex("c4fdf7b40a5477f206e6ee278eaef888ca73bf9128a9eef9f2f1ddb8b7b71a4c07cfa241f028a04edb405e4d916c61d6beabc333813dc7b484d2b3c52ee233c6a79b1eea4e9cc51596ba9cd5ac5aeb9df62d86ea051055b79d03f8a4fa9f38386f5bd17529138f3325d46801514ea9047977e0829ed728e68636802796801be1"),
49+
E: 65537,
50+
}
51+
52+
hash := fromHex("019c5571724fb5d0e47a4260c940e9803ba05a44")
53+
paddedHash := fromHex("3021300906052b0e03021a05000414019c5571724fb5d0e47a4260c940e9803ba05a44")
54+
55+
// signature is one byte shorter than key.N.
56+
sig := fromHex("5edfbeb6a73e7225ad3cc52724e2872e04260d7daf0d693c170d8c4b243b8767bc7785763533febc62ec2600c30603c433c095453ede59ff2fcabeb84ce32e0ed9d5cf15ffcbc816202b64370d4d77c1e9077d74e94a16fb4fa2e5bec23a56d7a73cf275f91691ae1801a976fcde09e981a2f6327ac27ea1fecf3185df0d56")
57+
58+
err := VerifyPKCS1v15(key, 0, paddedHash, sig)
59+
if err != nil {
60+
t.Errorf("raw: %v", err)
61+
}
62+
63+
err = VerifyPKCS1v15(key, crypto.SHA1, hash, sig)
64+
if err != nil {
65+
t.Errorf("sha1: %v", err)
66+
}
67+
}

0 commit comments

Comments
 (0)