1 // Copyright 2018 Google Inc.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/signature/rsa_ssa_pss_verify_key_manager.h"
18
19 #include <string>
20
21 #include "gmock/gmock.h"
22 #include "gtest/gtest.h"
23 #include "absl/status/status.h"
24 #include "absl/strings/escaping.h"
25 #include "openssl/rsa.h"
26 #include "tink/internal/bn_util.h"
27 #include "tink/internal/rsa_util.h"
28 #include "tink/internal/ssl_unique_ptr.h"
29 #include "tink/public_key_sign.h"
30 #include "tink/public_key_verify.h"
31 #include "tink/signature/rsa_ssa_pss_sign_key_manager.h"
32 #include "tink/subtle/rsa_ssa_pss_sign_boringssl.h"
33 #include "tink/util/secret_data.h"
34 #include "tink/util/status.h"
35 #include "tink/util/statusor.h"
36 #include "tink/util/test_matchers.h"
37 #include "tink/util/test_util.h"
38 #include "proto/rsa_ssa_pss.pb.h"
39
40 namespace crypto {
41 namespace tink {
42 namespace {
43
44 using ::crypto::tink::test::IsOk;
45 using ::crypto::tink::test::StatusIs;
46 using ::crypto::tink::util::StatusOr;
47 using ::google::crypto::tink::HashType;
48 using ::google::crypto::tink::KeyData;
49 using ::google::crypto::tink::RsaSsaPssKeyFormat;
50 using ::google::crypto::tink::RsaSsaPssPrivateKey;
51 using ::google::crypto::tink::RsaSsaPssPublicKey;
52 using ::testing::Eq;
53 using ::testing::HasSubstr;
54 using ::testing::Not;
55
TEST(RsaSsaPssVerifyKeyManagerTest,Basics)56 TEST(RsaSsaPssVerifyKeyManagerTest, Basics) {
57 EXPECT_THAT(RsaSsaPssVerifyKeyManager().get_version(), Eq(0));
58 EXPECT_THAT(RsaSsaPssVerifyKeyManager().key_material_type(),
59 Eq(KeyData::ASYMMETRIC_PUBLIC));
60 EXPECT_THAT(RsaSsaPssVerifyKeyManager().get_key_type(),
61 Eq("type.googleapis.com/google.crypto.tink.RsaSsaPssPublicKey"));
62 }
63
TEST(RsaSsaPssVerifyKeyManagerTest,ValidateEmptyKey)64 TEST(RsaSsaPssVerifyKeyManagerTest, ValidateEmptyKey) {
65 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(RsaSsaPssPublicKey()),
66 Not(IsOk()));
67 }
68
CreateKeyFormat(HashType sig_hash,HashType mgf1_hash,int salt_length,int modulus_size_in_bits,int public_exponent)69 RsaSsaPssKeyFormat CreateKeyFormat(HashType sig_hash, HashType mgf1_hash,
70 int salt_length, int modulus_size_in_bits,
71 int public_exponent) {
72 RsaSsaPssKeyFormat key_format;
73 auto params = key_format.mutable_params();
74 params->set_sig_hash(sig_hash);
75 params->set_mgf1_hash(mgf1_hash);
76 params->set_salt_length(salt_length);
77 key_format.set_modulus_size_in_bits(modulus_size_in_bits);
78
79 internal::SslUniquePtr<BIGNUM> e(BN_new());
80 BN_set_word(e.get(), public_exponent);
81 key_format.set_public_exponent(
82 internal::BignumToString(e.get(), BN_num_bytes(e.get())).value());
83
84 return key_format;
85 }
86
ValidKeyFormat()87 RsaSsaPssKeyFormat ValidKeyFormat() {
88 return CreateKeyFormat(HashType::SHA256, HashType::SHA256, 32, 3072, RSA_F4);
89 }
90
CreateValidPrivateKey()91 RsaSsaPssPrivateKey CreateValidPrivateKey() {
92 return RsaSsaPssSignKeyManager().CreateKey(ValidKeyFormat()).value();
93 }
94
CreateValidPublicKey()95 RsaSsaPssPublicKey CreateValidPublicKey() {
96 return RsaSsaPssSignKeyManager()
97 .GetPublicKey(CreateValidPrivateKey())
98 .value();
99 }
100
101 // Checks that a public key generaed by the SignKeyManager is considered valid.
TEST(RsaSsaPssVerifyKeyManagerTest,PublicKeyValid)102 TEST(RsaSsaPssVerifyKeyManagerTest, PublicKeyValid) {
103 RsaSsaPssPublicKey key = CreateValidPublicKey();
104 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), IsOk());
105 }
106
TEST(RsaSsaPssVerifyKeyManagerTest,PublicKeyWrongVersion)107 TEST(RsaSsaPssVerifyKeyManagerTest, PublicKeyWrongVersion) {
108 RsaSsaPssPublicKey key = CreateValidPublicKey();
109 key.set_version(1);
110 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), Not(IsOk()));
111 }
112
TEST(RsaSsaPssVerifyKeyManagerTest,PublicKeyHashMismatchDisallowed)113 TEST(RsaSsaPssVerifyKeyManagerTest, PublicKeyHashMismatchDisallowed) {
114 RsaSsaPssPublicKey key = CreateValidPublicKey();
115 key.mutable_params()->set_sig_hash(HashType::SHA512);
116 key.mutable_params()->set_mgf1_hash(HashType::SHA256);
117 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), Not(IsOk()));
118 }
119
TEST(RsaSsaPssVerifyKeyManagerTest,PublicKeyHashMismatchDisallowed2)120 TEST(RsaSsaPssVerifyKeyManagerTest, PublicKeyHashMismatchDisallowed2) {
121 RsaSsaPssPublicKey key = CreateValidPublicKey();
122 key.mutable_params()->set_sig_hash(HashType::SHA256);
123 key.mutable_params()->set_mgf1_hash(HashType::SHA512);
124 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), Not(IsOk()));
125 }
126
TEST(RsaSsaPssVerifyKeyManagerTest,PublicKeyUnkownHashDisallowed)127 TEST(RsaSsaPssVerifyKeyManagerTest, PublicKeyUnkownHashDisallowed) {
128 RsaSsaPssPublicKey key = CreateValidPublicKey();
129 key.mutable_params()->set_sig_hash(HashType::UNKNOWN_HASH);
130 key.mutable_params()->set_mgf1_hash(HashType::UNKNOWN_HASH);
131 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), Not(IsOk()));
132 }
133
TEST(RsaSsaPssVerifyKeyManagerTest,ValidateKeyFormatSmallModulusDisallowed)134 TEST(RsaSsaPssVerifyKeyManagerTest, ValidateKeyFormatSmallModulusDisallowed) {
135 RsaSsaPssPublicKey key = CreateValidPublicKey();
136 key.set_n("\x23");
137 key.set_e("\x3");
138 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key),
139 StatusIs(absl::StatusCode::kInvalidArgument,
140 HasSubstr("only modulus size >= 2048")));
141 }
142
TEST(RsaSsaPssVerifyKeyManagerTest,NegativeSaltLengthFails)143 TEST(RsaSsaPssVerifyKeyManagerTest, NegativeSaltLengthFails) {
144 RsaSsaPssPublicKey key = CreateValidPublicKey();
145 key.mutable_params()->set_salt_length(-5);
146 EXPECT_THAT(RsaSsaPssVerifyKeyManager().ValidateKey(key), Not(IsOk()));
147 }
148
TEST(RsaSsaPssSignKeyManagerTest,Create)149 TEST(RsaSsaPssSignKeyManagerTest, Create) {
150 RsaSsaPssKeyFormat key_format =
151 CreateKeyFormat(HashType::SHA256, HashType::SHA256, 32, 3072, RSA_F4);
152 StatusOr<RsaSsaPssPrivateKey> private_key_or =
153 RsaSsaPssSignKeyManager().CreateKey(key_format);
154 ASSERT_THAT(private_key_or, IsOk());
155 RsaSsaPssPrivateKey private_key = private_key_or.value();
156 RsaSsaPssPublicKey public_key =
157 RsaSsaPssSignKeyManager().GetPublicKey(private_key).value();
158
159 internal::RsaPrivateKey private_key_subtle;
160 private_key_subtle.n = private_key.public_key().n();
161 private_key_subtle.e = private_key.public_key().e();
162 private_key_subtle.d = util::SecretDataFromStringView(private_key.d());
163 private_key_subtle.p = util::SecretDataFromStringView(private_key.p());
164 private_key_subtle.q = util::SecretDataFromStringView(private_key.q());
165 private_key_subtle.dp = util::SecretDataFromStringView(private_key.dp());
166 private_key_subtle.dq = util::SecretDataFromStringView(private_key.dq());
167 private_key_subtle.crt = util::SecretDataFromStringView(private_key.crt());
168
169 auto direct_signer_or = subtle::RsaSsaPssSignBoringSsl::New(
170 private_key_subtle, {crypto::tink::subtle::HashType::SHA256,
171 crypto::tink::subtle::HashType::SHA256, 32});
172
173 auto verifier_or =
174 RsaSsaPssVerifyKeyManager().GetPrimitive<PublicKeyVerify>(public_key);
175 ASSERT_THAT(verifier_or, IsOk());
176
177 std::string message = "Some message";
178 EXPECT_THAT(verifier_or.value()->Verify(
179 direct_signer_or.value()->Sign(message).value(), message),
180 IsOk());
181 }
182
183 // Test vector from
184 // https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Digital-Signatures
185 struct NistTestVector {
186 std::string n;
187 std::string e;
188 std::string message;
189 std::string signature;
190 HashType sig_hash;
191 HashType mgf1_hash;
192 int salt_length;
193 };
194
195 // clang-format off
196 static const NistTestVector* nist_test_vector = new NistTestVector({
197 absl::HexStringToBytes(
198 "a47d04e7cacdba4ea26eca8a4c6e14563c2ce03b623b768c0d49868a57121301dbf783"
199 "d82f4c055e73960e70550187d0af62ac3496f0a3d9103c2eb7919a72752fa7ce8c688d"
200 "81e3aee99468887a15288afbb7acb845b7c522b5c64e678fcd3d22feb84b44272700be"
201 "527d2b2025a3f83c2383bf6a39cf5b4e48b3cf2f56eef0dfff18555e31037b91524869"
202 "4876f3047814415164f2c660881e694b58c28038a032ad25634aad7b39171dee368e3d"
203 "59bfb7299e4601d4587e68caaf8db457b75af42fc0cf1ae7caced286d77fac6cedb03a"
204 "d94f1433d2c94d08e60bc1fdef0543cd2951e765b38230fdd18de5d2ca627ddc032fe0"
205 "5bbd2ff21e2db1c2f94d8b"),
206 absl::HexStringToBytes("10e43f"),
207 absl::HexStringToBytes(
208 "e002377affb04f0fe4598de9d92d31d6c786040d5776976556a2cfc55e54a1dcb3cb1b"
209 "126bd6a4bed2a184990ccea773fcc79d246553e6c64f686d21ad4152673cafec22aeb4"
210 "0f6a084e8a5b4991f4c64cf8a927effd0fd775e71e8329e41fdd4457b3911173187b4f"
211 "09a817d79ea2397fc12dfe3d9c9a0290c8ead31b6690a6"),
212 absl::HexStringToBytes(
213 "4f9b425c2058460e4ab2f5c96384da2327fd29150f01955a76b4efe956af06dc08779a"
214 "374ee4607eab61a93adc5608f4ec36e47f2a0f754e8ff839a8a19b1db1e884ea4cf348"
215 "cd455069eb87afd53645b44e28a0a56808f5031da5ba9112768dfbfca44ebe63a0c057"
216 "2b731d66122fb71609be1480faa4e4f75e43955159d70f081e2a32fbb19a48b9f162cf"
217 "6b2fb445d2d6994bc58910a26b5943477803cdaaa1bd74b0da0a5d053d8b1dc593091d"
218 "b5388383c26079f344e2aea600d0e324164b450f7b9b465111b7265f3b1b063089ae7e"
219 "2623fc0fda8052cf4bf3379102fbf71d7c98e8258664ceed637d20f95ff0111881e650"
220 "ce61f251d9c3a629ef222d"),
221 HashType::SHA256,
222 HashType::SHA256,
223 32});
224 // clang-format on
225
TEST(RsaSsaPssVerifyKeyManagerTest,TestVector)226 TEST(RsaSsaPssVerifyKeyManagerTest, TestVector) {
227 RsaSsaPssPublicKey key;
228 key.mutable_params()->set_mgf1_hash(nist_test_vector->mgf1_hash);
229 key.mutable_params()->set_sig_hash(nist_test_vector->sig_hash);
230 key.mutable_params()->set_salt_length(nist_test_vector->salt_length);
231 key.set_version(0);
232 key.set_n(nist_test_vector->n);
233 key.set_e(nist_test_vector->e);
234 auto result = RsaSsaPssVerifyKeyManager().GetPrimitive<PublicKeyVerify>(key);
235 ASSERT_THAT(result, IsOk());
236 EXPECT_THAT(result.value()->Verify(nist_test_vector->signature,
237 nist_test_vector->message),
238 IsOk());
239 }
240
241 } // namespace
242 } // namespace tink
243 } // namespace crypto
244