WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

handle certificates with RSA-PSS signature that have RSAk public keys

pull/5615/head
Jacob Barthelmeh 2022-09-21 08:24:09 -06:00
parent 90c9363af8
commit dc0b2553fc
5 changed files with 147 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
certs/rsapss/include.am
View File

@ -52,7 +52,8 @@ EXTRA_DIST += \
certs/rsapss/server-3072-rsapss-key.der \
certs/rsapss/server-3072-rsapss-key.pem \
certs/rsapss/server-3072-rsapss-priv.der \
certs/rsapss/server-3072-rsapss-priv.pem
certs/rsapss/server-3072-rsapss-priv.pem \
certs/rsapss/server-mix-rsapss-cert.pem
EXTRA_DIST += \
certs/rsapss/renew-rsapss-certs.sh \

19
certs/rsapss/renew-rsapss-certs.sh
View File

@ -52,6 +52,25 @@ mv tmp.pem ca-rsapss.pem
echo "End of section"
echo "---------------------------------------------------------------------"
############################################################
####### update server-mix-rsapss.pem signed by ca ##########
############################################################
echo "Updating server-mix-rsapss.pem"
echo ""
#pipe the following arguments to openssl req...
echo -e "US\\nMontana\\nBozeman\\nwolfSSL_RSAPSS\\nServer-MIX-RSAPSS\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n\\n\\n\\n" | openssl req -new -key ../server-key.pem -config ../renewcerts/wolfssl.cnf -nodes -out server-mix-rsapss.csr
check_result $? "Generate request"
openssl x509 -req -in server-mix-rsapss.csr -days 1000 -extfile ../renewcerts/wolfssl.cnf -extensions server_ecc -CA ../ca-cert.pem -CAkey ../ca-key.pem -sigopt rsa_padding_mode:pss -set_serial 01 -out server-mix-rsapss-cert.pem
check_result $? "Generate certificate"
rm server-mix-rsapss.csr
openssl x509 -in server-mix-rsapss-cert.pem -text > tmp.pem
check_result $? "Add text"
mv tmp.pem server-mix-rsapss-cert.pem
echo "End of section"
echo "---------------------------------------------------------------------"
############################################################
####### update server-rsapss.pem signed by ca ##############
############################################################

100
certs/rsapss/server-mix-rsapss-cert.pem 100644
View File

@ -0,0 +1,100 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: rsassaPss
Hash Algorithm: sha256
Mask Algorithm: mgf1 with sha256
Salt Length: 0xDE
Trailer Field: 0xBC (default)
Issuer: C = US, ST = Montana, L = Bozeman, O = Sawtooth, OU = Consulting, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
Validity
Not Before: Sep 20 23:01:48 2022 GMT
Not After : Jun 16 23:01:48 2025 GMT
Subject: C = US, ST = Montana, L = Bozeman, O = wolfSSL_RSAPSS, OU = Server-MIX-RSAPSS, CN = www.wolfssl.com, emailAddress = info@wolfssl.com, UID = wolfSSL
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:c0:95:08:e1:57:41:f2:71:6d:b7:d2:45:41:27:
01:65:c6:45:ae:f2:bc:24:30:b8:95:ce:2f:4e:d6:
f6:1c:88:bc:7c:9f:fb:a8:67:7f:fe:5c:9c:51:75:
f7:8a:ca:07:e7:35:2f:8f:e1:bd:7b:c0:2f:7c:ab:
64:a8:17:fc:ca:5d:7b:ba:e0:21:e5:72:2e:6f:2e:
86:d8:95:73:da:ac:1b:53:b9:5f:3f:d7:19:0d:25:
4f:e1:63:63:51:8b:0b:64:3f:ad:43:b8:a5:1c:5c:
34:b3:ae:00:a0:63:c5:f6:7f:0b:59:68:78:73:a6:
8c:18:a9:02:6d:af:c3:19:01:2e:b8:10:e3:c6:cc:
40:b4:69:a3:46:33:69:87:6e:c4:bb:17:a6:f3:e8:
dd:ad:73:bc:7b:2f:21:b5:fd:66:51:0c:bd:54:b3:
e1:6d:5f:1c:bc:23:73:d1:09:03:89:14:d2:10:b9:
64:c3:2a:d0:a1:96:4a:bc:e1:d4:1a:5b:c7:a0:c0:
c1:63:78:0f:44:37:30:32:96:80:32:23:95:a1:77:
ba:13:d2:97:73:e2:5d:25:c9:6a:0d:c3:39:60:a4:
b4:b0:69:42:42:09:e9:d8:08:bc:33:20:b3:58:22:
a7:aa:eb:c4:e1:e6:61:83:c5:d2:96:df:d9:d0:4f:
ad:d7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
B3:11:32:C9:92:98:84:E2:C9:F8:D0:3B:6E:03:42:CA:1F:0E:8E:3C
X509v3 Authority Key Identifier:
keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
Netscape Cert Type:
SSL Server
Signature Algorithm: rsassaPss
Hash Algorithm: sha256
Mask Algorithm: mgf1 with sha256
Salt Length: 0xDE
Trailer Field: 0xBC (default)
33:53:6d:d1:35:14:22:63:54:8a:78:31:5b:dd:5e:86:55:e8:
a8:1f:ed:f2:b9:1a:ea:89:64:aa:39:87:21:15:aa:72:c9:65:
08:fb:36:09:d6:9a:a1:b2:39:59:2c:7a:0a:77:72:d9:60:27:
7a:6f:68:a6:a0:19:20:dd:d0:dd:21:d3:1d:06:ce:b5:60:9a:
2b:82:84:99:1b:06:56:95:8e:7a:cc:a4:ef:38:95:36:41:3d:
21:dc:d7:db:52:58:4a:ab:74:fc:50:87:c8:26:a1:0a:2e:e8:
e7:15:52:2f:32:b8:a5:69:61:79:13:1c:52:bd:9e:a5:31:89:
30:0e:50:8e:65:da:f5:13:fe:22:d6:57:0e:f4:32:b0:a6:5e:
53:ff:44:25:d5:e7:03:93:98:85:de:3d:3e:9c:a7:dc:45:62:
f8:96:f9:82:c3:5f:20:1e:37:c3:14:e7:9b:db:dc:5d:df:f4:
16:9a:93:8b:3c:47:3d:73:c8:55:ff:7f:00:15:1c:4d:bb:de:
76:d3:5a:2d:8f:0f:bf:88:d1:54:e6:13:5e:f0:a5:aa:b9:74:
64:ca:a8:22:cc:12:51:8a:84:be:35:31:d6:b3:b4:45:c5:9d:
87:53:32:7c:7a:be:21:e4:55:f4:f3:a7:14:7a:4d:17:b9:9c:
8f:1f:d8:fd
-----BEGIN CERTIFICATE-----
MIIEtzCCA26gAwIBAgIBATA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEa
MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4wgZQxCzAJBgNVBAYTAlVT
MRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhT
YXd0b290aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZz
c2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTIyMDky
MDIzMDE0OFoXDTI1MDYxNjIzMDE0OFowgboxCzAJBgNVBAYTAlVTMRAwDgYDVQQI
DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRcwFQYDVQQKDA53b2xmU1NMX1JT
QVBTUzEaMBgGA1UECwwRU2VydmVyLU1JWC1SU0FQU1MxGDAWBgNVBAMMD3d3dy53
b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTEXMBUG
CgmSJomT8ixkAQEMB3dvbGZTU0wwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDAlQjhV0HycW230kVBJwFlxkWu8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxR
dfeKygfnNS+P4b17wC98q2SoF/zKXXu64CHlci5vLobYlXParBtTuV8/1xkNJU/h
Y2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZaHhzpowYqQJtr8MZAS64EOPGzEC0aaNG
M2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1Us+FtXxy8I3PRCQOJFNIQuWTDKtChlkq8
4dQaW8egwMFjeA9ENzAyloAyI5Whd7oT0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwz
ILNYIqeq68Th5mGDxdKW39nQT63XAgMBAAGjgYkwgYYwHQYDVR0OBBYEFLMRMsmS
mITiyfjQO24DQsofDo48MB8GA1UdIwQYMBaAFCeOZxF0wyYdP+0zY7Ok2B0w5ejV
MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUF
BwMBMBEGCWCGSAGG+EIBAQQEAwIGQDA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFl
AwQCAaEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4DggEBADNTbdE1
FCJjVIp4MVvdXoZV6Kgf7fK5GuqJZKo5hyEVqnLJZQj7NgnWmqGyOVksegp3ctlg
J3pvaKagGSDd0N0h0x0GzrVgmiuChJkbBlaVjnrMpO84lTZBPSHc19tSWEqrdPxQ
h8gmoQou6OcVUi8yuKVpYXkTHFK9nqUxiTAOUI5l2vUT/iLWVw70MrCmXlP/RCXV
5wOTmIXePT6cp9xFYviW+YLDXyAeN8MU55vb3F3f9Baak4s8Rz1zyFX/fwAVHE27
3nbTWi2PD7+I0VTmE17wpaq5dGTKqCLMElGKhL41MdaztEXFnYdTMnx6viHkVfTz
pxR6TRe5nI8f2P0=
-----END CERTIFICATE-----

16
tests/test-rsapss.conf
View File

@ -72,3 +72,19 @@
-A ./certs/rsapss/root-rsapss.pem
-C
# server TLSv1.2 - RSA PSS SHA256 MGF1 SHA256
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-c ./certs/rsapss/server-mixed-rsapss-cert.pem
-k ./certs/server-key.pem
-A ./certs/rsapss/client-rsapss.pem
-V
# client TLSv1.2 - RSA PSS SHA256 MGF1 SHA256
-v 3
-l DHE-RSA-AES128-GCM-SHA256
-c ./certs/rsapss/client-rsapss.pem
-k ./certs/rsapss/client-rsapss-priv.pem
-A ./certs/ca-cert.pem
-C

15
wolfcrypt/src/asn.c
View File

@ -15395,7 +15395,7 @@ static int ConfirmSignature(SignatureCtx* sigCtx,
case SIG_STATE_HASH:
{
#if !defined(NO_RSA) && defined(WC_RSA_PSS)
if (keyOID == RSAPSSk) {
if (sigOID == RSAPSSk) {
word32 fakeSigOID = 0;
ret = DecodeRsaPssParams(sigParams, sigParamsSz, &sigCtx->hash,
&sigCtx->mgf, &sigCtx->saltLen);
@ -16061,15 +16061,17 @@ static int ConfirmSignature(SignatureCtx* sigCtx,
{
switch (keyOID) {
#ifndef NO_RSA
case RSAk:
#ifdef WC_RSA_PSS
case RSAPSSk:
if (sigOID == RSAPSSk) {
/* TODO: pkCbRsaPss - RSA PSS callback. */
ret = wc_RsaPSS_VerifyInline_ex(sigCtx->sigCpy, sigSz,
&sigCtx->out, sigCtx->hash, sigCtx->mgf,
sigCtx->saltLen, sigCtx->key.rsa);
break;
}
else
#endif
case RSAk:
{
#if defined(HAVE_PK_CALLBACKS)
if (sigCtx->pkCbRsa) {
@ -16089,8 +16091,8 @@ static int ConfirmSignature(SignatureCtx* sigCtx,
ret = wc_RsaSSL_VerifyInline(sigCtx->sigCpy, sigSz,
&sigCtx->out, sigCtx->key.rsa);
}
break;
}
break;
#endif /* !NO_RSA */
#if !defined(NO_DSA) && !defined(HAVE_SELFTEST)
case DSAk:
@ -16208,8 +16210,10 @@ static int ConfirmSignature(SignatureCtx* sigCtx,
{
switch (keyOID) {
#ifndef NO_RSA
case RSAk:
#ifdef WC_RSA_PSS
case RSAPSSk:
if (sigOID == RSAPSSk) {
#if (defined(HAVE_SELFTEST) && \
(!defined(HAVE_SELFTEST_VERSION) || \
(HAVE_SELFTEST_VERSION < 2))) || \
@ -16232,8 +16236,9 @@ static int ConfirmSignature(SignatureCtx* sigCtx,
sigCtx->heap);
#endif
break;
}
else
#endif
case RSAk:
{
int encodedSigSz, verifySz;
#if defined(WOLFSSL_RENESAS_TSIP_TLS) || \