Skip to content

Commit 178f96c

Browse files
douzzerdouzzer
authored
Merge pull request #9854 from sameehj/rsa-pss-fix
Add RSA-PSS certificate support for PKCS7 EnvelopedData KTRI
2 parents 26e2f05 + 441bcbb commit 178f96c

3 files changed

Lines changed: 108 additions & 3 deletions

File tree

‎tests/api/test_pkcs7.c‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1039,6 +1039,85 @@ int test_wc_PKCS7_EncodeSignedData_RSA_PSS(void)
10391039
#endif
10401040

10411041

1042+
/*
1043+
* Testing wc_PKCS7_EncodeEnvelopedData() with RSA-PSS signed certificate
1044+
* for KTRI key transport. Uses certs/rsapss/client-rsapss.der.
1045+
* Requires encode and round-trip decode to succeed.
1046+
*/
1047+
#if defined(HAVE_PKCS7) && defined(WC_RSA_PSS) && !defined(NO_RSA) && \
1048+
!defined(NO_FILESYSTEM) && !defined(NO_SHA256) && \
1049+
!defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256)
1050+
int test_wc_PKCS7_EnvelopedData_KTRI_RSA_PSS(void)
1051+
{
1052+
EXPECT_DECLS;
1053+
PKCS7* pkcs7 = NULL;
1054+
byte encrypted[FOURK_BUF];
1055+
byte decrypted[FOURK_BUF];
1056+
byte cert[FOURK_BUF];
1057+
byte key[FOURK_BUF];
1058+
word32 certSz = 0;
1059+
word32 keySz = 0;
1060+
XFILE fp = XBADFILE;
1061+
byte data[] = "Test data for RSA-PSS EnvelopedData KTRI.";
1062+
int encryptedSz = 0, decryptedSz = 0;
1063+
1064+
XMEMSET(cert, 0, sizeof(cert));
1065+
XMEMSET(key, 0, sizeof(key));
1066+
1067+
/* Load RSA-PSS client cert */
1068+
ExpectTrue((fp = XFOPEN("./certs/rsapss/client-rsapss.der", "rb"))
1069+
!= XBADFILE);
1070+
if (fp != XBADFILE) {
1071+
ExpectIntGT(certSz = (word32)XFREAD(cert, 1, sizeof(cert), fp), 0);
1072+
XFCLOSE(fp);
1073+
fp = XBADFILE;
1074+
}
1075+
1076+
/* Load RSA-PSS client private key */
1077+
ExpectTrue((fp = XFOPEN("./certs/rsapss/client-rsapss-priv.der", "rb"))
1078+
!= XBADFILE);
1079+
if (fp != XBADFILE) {
1080+
ExpectIntGT(keySz = (word32)XFREAD(key, 1, sizeof(key), fp), 0);
1081+
XFCLOSE(fp);
1082+
fp = XBADFILE;
1083+
}
1084+
1085+
/* Encode EnvelopedData with KTRI using RSA-PSS cert */
1086+
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
1087+
ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
1088+
if (pkcs7 != NULL) {
1089+
pkcs7->content = data;
1090+
pkcs7->contentSz = (word32)sizeof(data);
1091+
pkcs7->contentOID = DATA;
1092+
pkcs7->encryptOID = AES256CBCb;
1093+
}
1094+
1095+
ExpectIntGT(encryptedSz = wc_PKCS7_EncodeEnvelopedData(pkcs7,
1096+
encrypted, sizeof(encrypted)), 0);
1097+
wc_PKCS7_Free(pkcs7);
1098+
pkcs7 = NULL;
1099+
1100+
/* Decode EnvelopedData */
1101+
ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
1102+
ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
1103+
if (pkcs7 != NULL) {
1104+
pkcs7->privateKey = key;
1105+
pkcs7->privateKeySz = keySz;
1106+
}
1107+
1108+
ExpectIntGT(decryptedSz = wc_PKCS7_DecodeEnvelopedData(pkcs7,
1109+
encrypted, (word32)encryptedSz,
1110+
decrypted, sizeof(decrypted)), 0);
1111+
ExpectIntEQ(decryptedSz, (int)sizeof(data));
1112+
ExpectIntEQ(XMEMCMP(decrypted, data, sizeof(data)), 0);
1113+
1114+
wc_PKCS7_Free(pkcs7);
1115+
1116+
return EXPECT_RESULT();
1117+
} /* END test_wc_PKCS7_EnvelopedData_KTRI_RSA_PSS */
1118+
#endif
1119+
1120+
10421121
/*
10431122
* Testing wc_PKCS7_EncodeSignedData_ex() and wc_PKCS7_VerifySignedData_ex()
10441123
*/

‎tests/api/test_pkcs7.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ int test_wc_PKCS7_EncodeSignedData(void);
3333
!defined(NO_FILESYSTEM) && !defined(NO_SHA256)
3434
int test_wc_PKCS7_EncodeSignedData_RSA_PSS(void);
3535
#endif
36+
#if defined(HAVE_PKCS7) && defined(WC_RSA_PSS) && !defined(NO_RSA) && \
37+
!defined(NO_FILESYSTEM) && !defined(NO_SHA256) && \
38+
!defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256)
39+
int test_wc_PKCS7_EnvelopedData_KTRI_RSA_PSS(void);
40+
#endif
3641
int test_wc_PKCS7_EncodeSignedData_ex(void);
3742
int test_wc_PKCS7_VerifySignedData_RSA(void);
3843
int test_wc_PKCS7_VerifySignedData_ECC(void);
@@ -67,6 +72,15 @@ int test_wc_PKCS7_VerifySignedData_PKCS7ContentSeq(void);
6772
#define TEST_PKCS7_RSA_PSS_SD_DECL
6873
#endif
6974

75+
#if defined(HAVE_PKCS7) && defined(WC_RSA_PSS) && !defined(NO_RSA) && \
76+
!defined(NO_FILESYSTEM) && !defined(NO_SHA256) && \
77+
!defined(NO_AES) && defined(HAVE_AES_CBC) && defined(WOLFSSL_AES_256)
78+
#define TEST_PKCS7_RSA_PSS_ED_DECL \
79+
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_EnvelopedData_KTRI_RSA_PSS),
80+
#else
81+
#define TEST_PKCS7_RSA_PSS_ED_DECL
82+
#endif
83+
7084
#define TEST_PKCS7_SIGNED_DATA_DECLS \
7185
TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_InitWithCert), \
7286
TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_EncodeData), \
@@ -83,6 +97,7 @@ int test_wc_PKCS7_VerifySignedData_PKCS7ContentSeq(void);
8397
#define TEST_PKCS7_ENCRYPTED_DATA_DECLS \
8498
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_DecodeEnvelopedData_stream), \
8599
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_EncodeDecodeEnvelopedData), \
100+
TEST_PKCS7_RSA_PSS_ED_DECL \
86101
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_SetAESKeyWrapUnwrapCb), \
87102
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_GetEnvelopedDataKariRid), \
88103
TEST_DECL_GROUP("pkcs7_ed", test_wc_PKCS7_EncodeEncryptedData), \

‎wolfcrypt/src/pkcs7.c‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8344,7 +8344,11 @@ int wc_PKCS7_AddRecipient_KTRI(wc_PKCS7* pkcs7, const byte* cert, word32 certSz,
83448344
pkcs7->publicKeyOID = decoded->keyOID;
83458345

83468346
/* KeyEncryptionAlgorithmIdentifier, only support RSA now */
8347-
if (pkcs7->publicKeyOID != RSAk) {
8347+
if (pkcs7->publicKeyOID != RSAk
8348+
#ifdef WC_RSA_PSS
8349+
&& pkcs7->publicKeyOID != RSAPSSk
8350+
#endif
8351+
) {
83488352
FreeDecodedCert(decoded);
83498353
WC_FREE_VAR_EX(serial, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
83508354
WC_FREE_VAR_EX(keyAlgArray, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
@@ -8354,8 +8358,7 @@ int wc_PKCS7_AddRecipient_KTRI(wc_PKCS7* pkcs7, const byte* cert, word32 certSz,
83548358
return ALGO_ID_E;
83558359
}
83568360

8357-
keyEncAlgSz = (int)SetAlgoID((int)pkcs7->publicKeyOID, keyAlgArray,
8358-
oidKeyType, 0);
8361+
keyEncAlgSz = (int)SetAlgoID(RSAk, keyAlgArray, oidKeyType, 0);
83598362
if (keyEncAlgSz == 0) {
83608363
FreeDecodedCert(decoded);
83618364
WC_FREE_VAR_EX(serial, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
@@ -10230,6 +10233,10 @@ int wc_PKCS7_EncodeEnvelopedData(wc_PKCS7* pkcs7, byte* output, word32 outputSz)
1023010233
if (pkcs7->singleCert != NULL && pkcs7->singleCertSz > 0) {
1023110234
switch (pkcs7->publicKeyOID) {
1023210235
#ifndef NO_RSA
10236+
#ifdef WC_RSA_PSS
10237+
case RSAPSSk:
10238+
FALL_THROUGH;
10239+
#endif
1023310240
case RSAk:
1023410241
ret = wc_PKCS7_AddRecipient_KTRI(pkcs7, pkcs7->singleCert,
1023510242
pkcs7->singleCertSz, 0);
@@ -13547,6 +13554,10 @@ int wc_PKCS7_EncodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* output,
1354713554
if (pkcs7->singleCert != NULL && pkcs7->singleCertSz > 0) {
1354813555
switch (pkcs7->publicKeyOID) {
1354913556
#ifndef NO_RSA
13557+
#ifdef WC_RSA_PSS
13558+
case RSAPSSk:
13559+
FALL_THROUGH;
13560+
#endif
1355013561
case RSAk:
1355113562
ret = wc_PKCS7_AddRecipient_KTRI(pkcs7, pkcs7->singleCert,
1355213563
pkcs7->singleCertSz, 0);

0 commit comments

Comments
 (0)