2 * validator/val_secalgo.c - validator security algorithm functions.
4 * Copyright (c) 2012, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains helper functions for the validator module.
40 * These functions take raw data buffers, formatted for crypto verification,
41 * and do the library calls (for the crypto library in use).
44 #include "validator/val_secalgo.h"
45 #include "util/data/packed_rrset.h"
47 #include "ldns/rrdef.h"
48 #include "ldns/keyraw.h"
49 #include "ldns/sbuffer.h"
51 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
52 #error "Need crypto library to do digital signature cryptography"
55 /* OpenSSL implementation */
57 #ifdef HAVE_OPENSSL_ERR_H
58 #include <openssl/err.h>
61 #ifdef HAVE_OPENSSL_RAND_H
62 #include <openssl/rand.h>
65 #ifdef HAVE_OPENSSL_CONF_H
66 #include <openssl/conf.h>
69 #ifdef HAVE_OPENSSL_ENGINE_H
70 #include <openssl/engine.h>
74 * Return size of DS digest according to its hash algorithm.
75 * @param algo: DS digest algo.
76 * @return size in bytes of digest, or 0 if not supported.
79 ds_digest_size_supported(int algo)
84 return SHA_DIGEST_LENGTH;
86 #ifdef HAVE_EVP_SHA256
88 return SHA256_DIGEST_LENGTH;
92 if(EVP_get_digestbyname("md_gost94"))
98 return SHA384_DIGEST_LENGTH;
106 /** Perform GOST hash */
108 do_gost94(unsigned char* data, size_t len, unsigned char* dest)
110 const EVP_MD* md = EVP_get_digestbyname("md_gost94");
113 return sldns_digest_evp(data, (unsigned int)len, dest, md);
118 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
124 (void)SHA1(buf, len, res);
127 #ifdef HAVE_EVP_SHA256
129 (void)SHA256(buf, len, res);
134 if(do_gost94(buf, len, res))
140 (void)SHA384(buf, len, res);
144 verbose(VERB_QUERY, "unknown DS digest algorithm %d",
151 /** return true if DNSKEY algorithm id is supported */
153 dnskey_algo_id_is_supported(int id)
157 /* RFC 6725 deprecates RSAMD5 */
162 case LDNS_RSASHA1_NSEC3:
163 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
166 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
170 case LDNS_ECDSAP256SHA256:
171 case LDNS_ECDSAP384SHA384:
176 /* we support GOST if it can be loaded */
177 return sldns_key_EVP_load_gost_id();
185 * Output a libcrypto openssl error to the logfile.
186 * @param str: string to add to it.
187 * @param e: the error to output, error number from ERR_get_error().
190 log_crypto_error(const char* str, unsigned long e)
193 /* or use ERR_error_string if ERR_error_string_n is not avail TODO */
194 ERR_error_string_n(e, buf, sizeof(buf));
195 /* buf now contains */
196 /* error:[error code]:[library name]:[function name]:[reason string] */
197 log_err("%s crypto %s", str, buf);
201 * Setup DSA key digest in DER encoding ...
202 * @param sig: input is signature output alloced ptr (unless failure).
203 * caller must free alloced ptr if this routine returns true.
204 * @param len: input is initial siglen, output is output len.
205 * @return false on failure.
208 setup_dsa_sig(unsigned char** sig, unsigned int* len)
210 unsigned char* orig = *sig;
211 unsigned int origlen = *len;
216 /* extract the R and S field from the sig buffer */
217 if(origlen < 1 + 2*SHA_DIGEST_LENGTH)
221 (void) BN_bin2bn(orig + 1, SHA_DIGEST_LENGTH, R);
224 (void) BN_bin2bn(orig + 21, SHA_DIGEST_LENGTH, S);
225 dsasig = DSA_SIG_new();
226 if(!dsasig) return 0;
231 newlen = i2d_DSA_SIG(dsasig, sig);
233 DSA_SIG_free(dsasig);
237 *len = (unsigned int)newlen;
238 DSA_SIG_free(dsasig);
244 * Setup the ECDSA signature in its encoding that the library wants.
245 * Converts from plain numbers to ASN formatted.
246 * @param sig: input is signature, output alloced ptr (unless failure).
247 * caller must free alloced ptr if this routine returns true.
248 * @param len: input is initial siglen, output is output len.
249 * @return false on failure.
252 setup_ecdsa_sig(unsigned char** sig, unsigned int* len)
254 ECDSA_SIG* ecdsa_sig;
256 int bnsize = (int)((*len)/2);
257 /* if too short or not even length, fails */
258 if(*len < 16 || bnsize*2 != (int)*len)
260 /* use the raw data to parse two evenly long BIGNUMs, "r | s". */
261 ecdsa_sig = ECDSA_SIG_new();
262 if(!ecdsa_sig) return 0;
263 ecdsa_sig->r = BN_bin2bn(*sig, bnsize, ecdsa_sig->r);
264 ecdsa_sig->s = BN_bin2bn(*sig+bnsize, bnsize, ecdsa_sig->s);
265 if(!ecdsa_sig->r || !ecdsa_sig->s) {
266 ECDSA_SIG_free(ecdsa_sig);
270 /* spool it into ASN format */
272 newlen = i2d_ECDSA_SIG(ecdsa_sig, sig);
274 ECDSA_SIG_free(ecdsa_sig);
278 *len = (unsigned int)newlen;
279 ECDSA_SIG_free(ecdsa_sig);
282 #endif /* USE_ECDSA */
285 * Setup key and digest for verification. Adjust sig if necessary.
287 * @param algo: key algorithm
288 * @param evp_key: EVP PKEY public key to create.
289 * @param digest_type: digest type to use
290 * @param key: key to setup for.
291 * @param keylen: length of key.
292 * @return false on failure.
295 setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
296 unsigned char* key, size_t keylen)
304 *evp_key = EVP_PKEY_new();
306 log_err("verify: malloc failure in crypto");
309 dsa = sldns_key_buf2dsa_raw(key, keylen);
311 verbose(VERB_QUERY, "verify: "
312 "sldns_key_buf2dsa_raw failed");
315 if(EVP_PKEY_assign_DSA(*evp_key, dsa) == 0) {
316 verbose(VERB_QUERY, "verify: "
317 "EVP_PKEY_assign_DSA failed");
320 *digest_type = EVP_dss1();
324 case LDNS_RSASHA1_NSEC3:
325 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
328 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
331 *evp_key = EVP_PKEY_new();
333 log_err("verify: malloc failure in crypto");
336 rsa = sldns_key_buf2rsa_raw(key, keylen);
338 verbose(VERB_QUERY, "verify: "
339 "sldns_key_buf2rsa_raw SHA failed");
342 if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
343 verbose(VERB_QUERY, "verify: "
344 "EVP_PKEY_assign_RSA SHA failed");
348 /* select SHA version */
349 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
350 if(algo == LDNS_RSASHA256)
351 *digest_type = EVP_sha256();
354 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
355 if(algo == LDNS_RSASHA512)
356 *digest_type = EVP_sha512();
359 *digest_type = EVP_sha1();
363 *evp_key = EVP_PKEY_new();
365 log_err("verify: malloc failure in crypto");
368 rsa = sldns_key_buf2rsa_raw(key, keylen);
370 verbose(VERB_QUERY, "verify: "
371 "sldns_key_buf2rsa_raw MD5 failed");
374 if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
375 verbose(VERB_QUERY, "verify: "
376 "EVP_PKEY_assign_RSA MD5 failed");
379 *digest_type = EVP_md5();
384 *evp_key = sldns_gost2pkey_raw(key, keylen);
386 verbose(VERB_QUERY, "verify: "
387 "sldns_gost2pkey_raw failed");
390 *digest_type = EVP_get_digestbyname("md_gost94");
392 verbose(VERB_QUERY, "verify: "
393 "EVP_getdigest md_gost94 failed");
399 case LDNS_ECDSAP256SHA256:
400 *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
401 LDNS_ECDSAP256SHA256);
403 verbose(VERB_QUERY, "verify: "
404 "sldns_ecdsa2pkey_raw failed");
407 #ifdef USE_ECDSA_EVP_WORKAROUND
408 /* openssl before 1.0.0 fixes RSA with the SHA256
409 * hash in EVP. We create one for ecdsa_sha256 */
411 static int md_ecdsa_256_done = 0;
413 if(!md_ecdsa_256_done) {
414 EVP_MD m = *EVP_sha256();
415 md_ecdsa_256_done = 1;
416 m.required_pkey_type[0] = (*evp_key)->type;
417 m.verify = (void*)ECDSA_verify;
423 *digest_type = EVP_sha256();
426 case LDNS_ECDSAP384SHA384:
427 *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
428 LDNS_ECDSAP384SHA384);
430 verbose(VERB_QUERY, "verify: "
431 "sldns_ecdsa2pkey_raw failed");
434 #ifdef USE_ECDSA_EVP_WORKAROUND
435 /* openssl before 1.0.0 fixes RSA with the SHA384
436 * hash in EVP. We create one for ecdsa_sha384 */
438 static int md_ecdsa_384_done = 0;
440 if(!md_ecdsa_384_done) {
441 EVP_MD m = *EVP_sha384();
442 md_ecdsa_384_done = 1;
443 m.required_pkey_type[0] = (*evp_key)->type;
444 m.verify = (void*)ECDSA_verify;
450 *digest_type = EVP_sha384();
453 #endif /* USE_ECDSA */
455 verbose(VERB_QUERY, "verify: unknown algorithm %d",
463 * Check a canonical sig+rrset and signature against a dnskey
464 * @param buf: buffer with data to verify, the first rrsig part and the
465 * canonicalized rrset.
466 * @param algo: DNSKEY algorithm.
467 * @param sigblock: signature rdata field from RRSIG
468 * @param sigblock_len: length of sigblock data.
469 * @param key: public key data from DNSKEY RR.
470 * @param keylen: length of keydata.
471 * @param reason: bogus reason in more detail.
472 * @return secure if verification succeeded, bogus on crypto failure,
473 * unchecked on format errors and alloc failures.
476 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
477 unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
480 const EVP_MD *digest_type;
483 EVP_PKEY *evp_key = NULL;
485 if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
486 verbose(VERB_QUERY, "verify: failed to setup key");
487 *reason = "use of key for crypto failed";
488 EVP_PKEY_free(evp_key);
489 return sec_status_bogus;
491 /* if it is a DSA signature in bind format, convert to DER format */
492 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&
493 sigblock_len == 1+2*SHA_DIGEST_LENGTH) {
494 if(!setup_dsa_sig(&sigblock, &sigblock_len)) {
495 verbose(VERB_QUERY, "verify: failed to setup DSA sig");
496 *reason = "use of key for DSA crypto failed";
497 EVP_PKEY_free(evp_key);
498 return sec_status_bogus;
503 else if(algo == LDNS_ECDSAP256SHA256 || algo == LDNS_ECDSAP384SHA384) {
504 /* EVP uses ASN prefix on sig, which is not in the wire data */
505 if(!setup_ecdsa_sig(&sigblock, &sigblock_len)) {
506 verbose(VERB_QUERY, "verify: failed to setup ECDSA sig");
507 *reason = "use of signature for ECDSA crypto failed";
508 EVP_PKEY_free(evp_key);
509 return sec_status_bogus;
513 #endif /* USE_ECDSA */
515 /* do the signature cryptography work */
516 EVP_MD_CTX_init(&ctx);
517 if(EVP_VerifyInit(&ctx, digest_type) == 0) {
518 verbose(VERB_QUERY, "verify: EVP_VerifyInit failed");
519 EVP_PKEY_free(evp_key);
520 if(dofree) free(sigblock);
521 return sec_status_unchecked;
523 if(EVP_VerifyUpdate(&ctx, (unsigned char*)sldns_buffer_begin(buf),
524 (unsigned int)sldns_buffer_limit(buf)) == 0) {
525 verbose(VERB_QUERY, "verify: EVP_VerifyUpdate failed");
526 EVP_PKEY_free(evp_key);
527 if(dofree) free(sigblock);
528 return sec_status_unchecked;
531 res = EVP_VerifyFinal(&ctx, sigblock, sigblock_len, evp_key);
532 if(EVP_MD_CTX_cleanup(&ctx) == 0) {
533 verbose(VERB_QUERY, "verify: EVP_MD_CTX_cleanup failed");
534 EVP_PKEY_free(evp_key);
535 if(dofree) free(sigblock);
536 return sec_status_unchecked;
538 EVP_PKEY_free(evp_key);
544 return sec_status_secure;
545 } else if(res == 0) {
546 verbose(VERB_QUERY, "verify: signature mismatch");
547 *reason = "signature crypto failed";
548 return sec_status_bogus;
551 log_crypto_error("verify:", ERR_get_error());
552 return sec_status_unchecked;
555 /**************************************************/
556 #elif defined(HAVE_NSS)
557 /* libnss implementation */
563 #include "cryptohi.h"
568 ds_digest_size_supported(int algo)
576 return SHA256_LENGTH;
580 return SHA384_LENGTH;
582 /* GOST not supported in NSS */
590 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
596 return HASH_HashBuf(HASH_AlgSHA1, res, buf, len)
598 #if defined(USE_SHA2)
600 return HASH_HashBuf(HASH_AlgSHA256, res, buf, len)
605 return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
610 verbose(VERB_QUERY, "unknown DS digest algorithm %d",
618 dnskey_algo_id_is_supported(int id)
623 /* RFC 6725 deprecates RSAMD5 */
628 case LDNS_RSASHA1_NSEC3:
637 case LDNS_ECDSAP256SHA256:
638 case LDNS_ECDSAP384SHA384:
639 return PK11_TokenExists(CKM_ECDSA);
647 /* return a new public key for NSS */
648 static SECKEYPublicKey* nss_key_create(KeyType ktype)
650 SECKEYPublicKey* key;
651 PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
653 log_err("out of memory, PORT_NewArena failed");
656 key = PORT_ArenaZNew(arena, SECKEYPublicKey);
658 log_err("out of memory, PORT_ArenaZNew failed");
659 PORT_FreeArena(arena, PR_FALSE);
663 key->keyType = ktype;
664 key->pkcs11Slot = NULL;
665 key->pkcs11ID = CK_INVALID_HANDLE;
669 static SECKEYPublicKey* nss_buf2ecdsa(unsigned char* key, size_t len, int algo)
672 SECItem pub = {siBuffer, NULL, 0};
673 SECItem params = {siBuffer, NULL, 0};
674 static unsigned char param256[] = {
675 /* OBJECTIDENTIFIER 1.2.840.10045.3.1.7 (P-256)
676 * {iso(1) member-body(2) us(840) ansi-x962(10045) curves(3) prime(1) prime256v1(7)} */
677 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
679 static unsigned char param384[] = {
680 /* OBJECTIDENTIFIER 1.3.132.0.34 (P-384)
681 * {iso(1) identified-organization(3) certicom(132) curve(0) ansip384r1(34)} */
682 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22
684 unsigned char buf[256+2]; /* sufficient for 2*384/8+1 */
686 /* check length, which uncompressed must be 2 bignums */
687 if(algo == LDNS_ECDSAP256SHA256) {
688 if(len != 2*256/8) return NULL;
689 /* ECCurve_X9_62_PRIME_256V1 */
690 } else if(algo == LDNS_ECDSAP384SHA384) {
691 if(len != 2*384/8) return NULL;
692 /* ECCurve_X9_62_PRIME_384R1 */
695 buf[0] = 0x04; /* POINT_FORM_UNCOMPRESSED */
696 memmove(buf+1, key, len);
699 if(algo == LDNS_ECDSAP256SHA256) {
700 params.data = param256;
701 params.len = sizeof(param256);
703 params.data = param384;
704 params.len = sizeof(param384);
707 pk = nss_key_create(ecKey);
710 pk->u.ec.size = (len/2)*8;
711 if(SECITEM_CopyItem(pk->arena, &pk->u.ec.publicValue, &pub)) {
712 SECKEY_DestroyPublicKey(pk);
715 if(SECITEM_CopyItem(pk->arena, &pk->u.ec.DEREncodedParams, ¶ms)) {
716 SECKEY_DestroyPublicKey(pk);
723 static SECKEYPublicKey* nss_buf2dsa(unsigned char* key, size_t len)
729 SECItem Q = {siBuffer, NULL, 0};
730 SECItem P = {siBuffer, NULL, 0};
731 SECItem G = {siBuffer, NULL, 0};
732 SECItem Y = {siBuffer, NULL, 0};
737 length = (64 + T * 8);
743 if(len < (size_t)1 + SHA1_LENGTH + 3*length)
748 offset += SHA1_LENGTH;
762 pk = nss_key_create(dsaKey);
765 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.prime, &P)) {
766 SECKEY_DestroyPublicKey(pk);
769 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.subPrime, &Q)) {
770 SECKEY_DestroyPublicKey(pk);
773 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.base, &G)) {
774 SECKEY_DestroyPublicKey(pk);
777 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.publicValue, &Y)) {
778 SECKEY_DestroyPublicKey(pk);
784 static SECKEYPublicKey* nss_buf2rsa(unsigned char* key, size_t len)
790 SECItem modulus = {siBuffer, NULL, 0};
791 SECItem exponent = {siBuffer, NULL, 0};
797 /* the exponent is too large so it's places further */
798 memmove(&int16, key+1, 2);
806 /* key length at least one */
807 if(len < (size_t)offset + exp + 1)
810 exponent.data = key+offset;
813 modulus.data = key+offset;
814 modulus.len = (len - offset);
816 pk = nss_key_create(rsaKey);
819 if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.modulus, &modulus)) {
820 SECKEY_DestroyPublicKey(pk);
823 if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.publicExponent, &exponent)) {
824 SECKEY_DestroyPublicKey(pk);
831 * Setup key and digest for verification. Adjust sig if necessary.
833 * @param algo: key algorithm
834 * @param evp_key: EVP PKEY public key to create.
835 * @param digest_type: digest type to use
836 * @param key: key to setup for.
837 * @param keylen: length of key.
838 * @param prefix: if returned, the ASN prefix for the hashblob.
839 * @param prefixlen: length of the prefix.
840 * @return false on failure.
843 nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
844 unsigned char* key, size_t keylen, unsigned char** prefix,
849 /* hash prefix for md5, RFC2537 */
850 static unsigned char p_md5[] = {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a,
851 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10};
852 /* hash prefix to prepend to hash output, from RFC3110 */
853 static unsigned char p_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B,
854 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14};
856 static unsigned char p_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
857 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
858 static unsigned char p_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
859 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
861 /* for future RSASHA384 ..
862 static unsigned char p_sha384[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
863 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30};
869 *pubkey = nss_buf2dsa(key, keylen);
871 log_err("verify: malloc failure in crypto");
874 *htype = HASH_AlgSHA1;
875 /* no prefix for DSA verification */
878 case LDNS_RSASHA1_NSEC3:
885 *pubkey = nss_buf2rsa(key, keylen);
887 log_err("verify: malloc failure in crypto");
890 /* select SHA version */
892 if(algo == LDNS_RSASHA256) {
893 *htype = HASH_AlgSHA256;
895 *prefixlen = sizeof(p_sha256);
899 if(algo == LDNS_RSASHA512) {
900 *htype = HASH_AlgSHA512;
902 *prefixlen = sizeof(p_sha512);
906 *htype = HASH_AlgSHA1;
908 *prefixlen = sizeof(p_sha1);
913 *pubkey = nss_buf2rsa(key, keylen);
915 log_err("verify: malloc failure in crypto");
918 *htype = HASH_AlgMD5;
920 *prefixlen = sizeof(p_md5);
924 case LDNS_ECDSAP256SHA256:
925 *pubkey = nss_buf2ecdsa(key, keylen,
926 LDNS_ECDSAP256SHA256);
928 log_err("verify: malloc failure in crypto");
931 *htype = HASH_AlgSHA256;
932 /* no prefix for DSA verification */
934 case LDNS_ECDSAP384SHA384:
935 *pubkey = nss_buf2ecdsa(key, keylen,
936 LDNS_ECDSAP384SHA384);
938 log_err("verify: malloc failure in crypto");
941 *htype = HASH_AlgSHA384;
942 /* no prefix for DSA verification */
944 #endif /* USE_ECDSA */
947 verbose(VERB_QUERY, "verify: unknown algorithm %d",
955 * Check a canonical sig+rrset and signature against a dnskey
956 * @param buf: buffer with data to verify, the first rrsig part and the
957 * canonicalized rrset.
958 * @param algo: DNSKEY algorithm.
959 * @param sigblock: signature rdata field from RRSIG
960 * @param sigblock_len: length of sigblock data.
961 * @param key: public key data from DNSKEY RR.
962 * @param keylen: length of keydata.
963 * @param reason: bogus reason in more detail.
964 * @return secure if verification succeeded, bogus on crypto failure,
965 * unchecked on format errors and alloc failures.
968 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
969 unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
973 /* large enough for the different hashes */
974 unsigned char hash[HASH_LENGTH_MAX];
975 unsigned char hash2[HASH_LENGTH_MAX*2];
976 HASH_HashType htype = 0;
977 SECKEYPublicKey* pubkey = NULL;
978 SECItem secsig = {siBuffer, sigblock, sigblock_len};
979 SECItem sechash = {siBuffer, hash, 0};
981 unsigned char* prefix = NULL; /* prefix for hash, RFC3110, RFC5702 */
982 size_t prefixlen = 0;
985 if(!nss_setup_key_digest(algo, &pubkey, &htype, key, keylen,
986 &prefix, &prefixlen)) {
987 verbose(VERB_QUERY, "verify: failed to setup key");
988 *reason = "use of key for crypto failed";
989 SECKEY_DestroyPublicKey(pubkey);
990 return sec_status_bogus;
993 /* need to convert DSA, ECDSA signatures? */
994 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3)) {
995 if(sigblock_len == 1+2*SHA1_LENGTH) {
999 SECItem* p = DSAU_DecodeDerSig(&secsig);
1001 verbose(VERB_QUERY, "verify: failed DER decode");
1002 *reason = "signature DER decode failed";
1003 SECKEY_DestroyPublicKey(pubkey);
1004 return sec_status_bogus;
1006 if(SECITEM_CopyItem(pubkey->arena, &secsig, p)) {
1007 log_err("alloc failure in DER decode");
1008 SECKEY_DestroyPublicKey(pubkey);
1009 SECITEM_FreeItem(p, PR_TRUE);
1010 return sec_status_unchecked;
1012 SECITEM_FreeItem(p, PR_TRUE);
1016 /* do the signature cryptography work */
1018 sechash.len = HASH_ResultLen(htype);
1019 if(sechash.len > sizeof(hash)) {
1020 verbose(VERB_QUERY, "verify: hash too large for buffer");
1021 SECKEY_DestroyPublicKey(pubkey);
1022 return sec_status_unchecked;
1024 if(HASH_HashBuf(htype, hash, (unsigned char*)sldns_buffer_begin(buf),
1025 (unsigned int)sldns_buffer_limit(buf)) != SECSuccess) {
1026 verbose(VERB_QUERY, "verify: HASH_HashBuf failed");
1027 SECKEY_DestroyPublicKey(pubkey);
1028 return sec_status_unchecked;
1031 int hashlen = sechash.len;
1032 if(prefixlen+hashlen > sizeof(hash2)) {
1033 verbose(VERB_QUERY, "verify: hashprefix too large");
1034 SECKEY_DestroyPublicKey(pubkey);
1035 return sec_status_unchecked;
1037 sechash.data = hash2;
1038 sechash.len = prefixlen+hashlen;
1039 memcpy(sechash.data, prefix, prefixlen);
1040 memmove(sechash.data+prefixlen, hash, hashlen);
1043 /* verify the signature */
1044 res = PK11_Verify(pubkey, &secsig, &sechash, NULL /*wincx*/);
1045 SECKEY_DestroyPublicKey(pubkey);
1047 if(res == SECSuccess) {
1048 return sec_status_secure;
1050 err = PORT_GetError();
1051 if(err != SEC_ERROR_BAD_SIGNATURE) {
1052 /* failed to verify */
1053 verbose(VERB_QUERY, "verify: PK11_Verify failed: %s",
1054 PORT_ErrorToString(err));
1055 /* if it is not supported, like ECC is removed, we get,
1056 * SEC_ERROR_NO_MODULE */
1057 if(err == SEC_ERROR_NO_MODULE)
1058 return sec_status_unchecked;
1059 /* but other errors are commonly returned
1060 * for a bad signature from NSS. Thus we return bogus,
1062 *reason = "signature crypto failed";
1063 return sec_status_bogus;
1065 verbose(VERB_QUERY, "verify: signature mismatch: %s",
1066 PORT_ErrorToString(err));
1067 *reason = "signature crypto failed";
1068 return sec_status_bogus;
1072 #endif /* HAVE_SSL or HAVE_NSS */