@pulse-compute/crypto 1.0.0-beta.5 → 1.0.0-beta.6

package/guests/es256-rustcrypto/source/bearssl/src/rsa/rsa_i31_priv.c

@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining 
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be 
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "inner.h"
+
+#define U      (2 + ((BR_MAX_RSA_FACTOR + 30) / 31))
+#define TLEN   (8 * U)
+
+/* see bearssl_rsa.h */
+uint32_t
+br_rsa_i31_private(unsigned char *x, const br_rsa_private_key *sk)
+{
+	const unsigned char *p, *q;
+	size_t plen, qlen;
+	size_t fwlen;
+	uint32_t p0i, q0i;
+	size_t xlen, u;
+	uint32_t tmp[1 + TLEN];
+	long z;
+	uint32_t *mp, *mq, *s1, *s2, *t1, *t2, *t3;
+	uint32_t r;
+
+	/*
+	 * Compute the actual lengths of p and q, in bytes.
+	 * These lengths are not considered secret (we cannot really hide
+	 * them anyway in constant-time code).
+	 */
+	p = sk->p;
+	plen = sk->plen;
+	while (plen > 0 && *p == 0) {
+		p ++;
+		plen --;
+	}
+	q = sk->q;
+	qlen = sk->qlen;
+	while (qlen > 0 && *q == 0) {
+		q ++;
+		qlen --;
+	}
+
+	/*
+	 * Compute the maximum factor length, in words.
+	 */
+	z = (long)(plen > qlen ? plen : qlen) << 3;
+	fwlen = 1;
+	while (z > 0) {
+		z -= 31;
+		fwlen ++;
+	}
+
+	/*
+	 * Round up the word length to an even number.
+	 */
+	fwlen += (fwlen & 1);
+
+	/*
+	 * We need to fit at least 6 values in the stack buffer.
+	 */
+	if (6 * fwlen > TLEN) {
+		return 0;
+	}
+
+	/*
+	 * Compute modulus length (in bytes).
+	 */
+	xlen = (sk->n_bitlen + 7) >> 3;
+
+	/*
+	 * Decode q.
+	 */
+	mq = tmp;
+	br_i31_decode(mq, q, qlen);
+
+	/*
+	 * Decode p.
+	 */
+	t1 = mq + fwlen;
+	br_i31_decode(t1, p, plen);
+
+	/*
+	 * Compute the modulus (product of the two factors), to compare
+	 * it with the source value. We use br_i31_mulacc(), since it's
+	 * already used later on.
+	 */
+	t2 = mq + 2 * fwlen;
+	br_i31_zero(t2, mq[0]);
+	br_i31_mulacc(t2, mq, t1);
+
+	/*
+	 * We encode the modulus into bytes, to perform the comparison
+	 * with bytes. We know that the product length, in bytes, is
+	 * exactly xlen.
+	 * The comparison actually computes the carry when subtracting
+	 * the modulus from the source value; that carry must be 1 for
+	 * a value in the correct range. We keep it in r, which is our
+	 * accumulator for the error code.
+	 */
+	t3 = mq + 4 * fwlen;
+	br_i31_encode(t3, xlen, t2);
+	u = xlen;
+	r = 0;
+	while (u > 0) {
+		uint32_t wn, wx;
+
+		u --;
+		wn = ((unsigned char *)t3)[u];
+		wx = x[u];
+		r = ((wx - (wn + r)) >> 8) & 1;
+	}
+
+	/*
+	 * Move the decoded p to another temporary buffer.
+	 */
+	mp = mq + 2 * fwlen;
+	memmove(mp, t1, fwlen * sizeof *t1);
+
+	/*
+	 * Compute s2 = x^dq mod q.
+	 */
+	q0i = br_i31_ninv31(mq[1]);
+	s2 = mq + fwlen;
+	br_i31_decode_reduce(s2, x, xlen, mq);
+	r &= br_i31_modpow_opt(s2, sk->dq, sk->dqlen, mq, q0i,
+		mq + 3 * fwlen, TLEN - 3 * fwlen);
+
+	/*
+	 * Compute s1 = x^dp mod p.
+	 */
+	p0i = br_i31_ninv31(mp[1]);
+	s1 = mq + 3 * fwlen;
+	br_i31_decode_reduce(s1, x, xlen, mp);
+	r &= br_i31_modpow_opt(s1, sk->dp, sk->dplen, mp, p0i,
+		mq + 4 * fwlen, TLEN - 4 * fwlen);
+
+	/*
+	 * Compute:
+	 *   h = (s1 - s2)*(1/q) mod p
+	 * s1 is an integer modulo p, but s2 is modulo q. PKCS#1 is
+	 * unclear about whether p may be lower than q (some existing,
+	 * widely deployed implementations of RSA don't tolerate p < q),
+	 * but we want to support that occurrence, so we need to use the
+	 * reduction function.
+	 *
+	 * Since we use br_i31_decode_reduce() for iq (purportedly, the
+	 * inverse of q modulo p), we also tolerate improperly large
+	 * values for this parameter.
+	 */
+	t1 = mq + 4 * fwlen;
+	t2 = mq + 5 * fwlen;
+	br_i31_reduce(t2, s2, mp);
+	br_i31_add(s1, mp, br_i31_sub(s1, t2, 1));
+	br_i31_to_monty(s1, mp);
+	br_i31_decode_reduce(t1, sk->iq, sk->iqlen, mp);
+	br_i31_montymul(t2, s1, t1, mp, p0i);
+
+	/*
+	 * h is now in t2. We compute the final result:
+	 *   s = s2 + q*h
+	 * All these operations are non-modular.
+	 *
+	 * We need mq, s2 and t2. We use the t3 buffer as destination.
+	 * The buffers mp, s1 and t1 are no longer needed, so we can
+	 * reuse them for t3. Moreover, the first step of the computation
+	 * is to copy s2 into t3, after which s2 is not needed. Right
+	 * now, mq is in slot 0, s2 is in slot 1, and t2 is in slot 5.
+	 * Therefore, we have ample room for t3 by simply using s2.
+	 */
+	t3 = s2;
+	br_i31_mulacc(t3, mq, t2);
+
+	/*
+	 * Encode the result. Since we already checked the value of xlen,
+	 * we can just use it right away.
+	 */
+	br_i31_encode(x, xlen, t3);
+
+	/*
+	 * The only error conditions remaining at that point are invalid
+	 * values for p and q (even integers).
+	 */
+	return p0i & q0i & r;
+}

package/guests/es256-rustcrypto/source/bearssl/src/rsa/rsa_i31_pub.c

@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining 
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be 
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "inner.h"
+
+/*
+ * As a strict minimum, we need four buffers that can hold a
+ * modular integer.
+ */
+#define TLEN   (4 * (2 + ((BR_MAX_RSA_SIZE + 30) / 31)))
+
+/* see bearssl_rsa.h */
+uint32_t
+br_rsa_i31_public(unsigned char *x, size_t xlen,
+	const br_rsa_public_key *pk)
+{
+	const unsigned char *n;
+	size_t nlen;
+	uint32_t tmp[1 + TLEN];
+	uint32_t *m, *a, *t;
+	size_t fwlen;
+	long z;
+	uint32_t m0i, r;
+
+	/*
+	 * Get the actual length of the modulus, and see if it fits within
+	 * our stack buffer. We also check that the length of x[] is valid.
+	 */
+	n = pk->n;
+	nlen = pk->nlen;
+	while (nlen > 0 && *n == 0) {
+		n ++;
+		nlen --;
+	}
+	if (nlen == 0 || nlen > (BR_MAX_RSA_SIZE >> 3) || xlen != nlen) {
+		return 0;
+	}
+	z = (long)nlen << 3;
+	fwlen = 1;
+	while (z > 0) {
+		z -= 31;
+		fwlen ++;
+	}
+	/*
+	 * Round up length to an even number.
+	 */
+	fwlen += (fwlen & 1);
+
+	/*
+	 * The modulus gets decoded into m[].
+	 * The value to exponentiate goes into a[].
+	 * The temporaries for modular exponentiation are in t[].
+	 */
+	m = tmp;
+	a = m + fwlen;
+	t = m + 2 * fwlen;
+
+	/*
+	 * Decode the modulus.
+	 */
+	br_i31_decode(m, n, nlen);
+	m0i = br_i31_ninv31(m[1]);
+
+	/*
+	 * Note: if m[] is even, then m0i == 0. Otherwise, m0i must be
+	 * an odd integer.
+	 */
+	r = m0i & 1;
+
+	/*
+	 * Decode x[] into a[]; we also check that its value is proper.
+	 */
+	r &= br_i31_decode_mod(a, x, xlen, m);
+
+	/*
+	 * Compute the modular exponentiation.
+	 */
+	br_i31_modpow_opt(a, pk->e, pk->elen, m, m0i, t, TLEN - 2 * fwlen);
+
+	/*
+	 * Encode the result.
+	 */
+	br_i31_encode(x, xlen, a);
+	return r;
+}

package/guests/es256-rustcrypto/source/bearssl/src/rsa/rsa_pkcs1_sig_pad.c

@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining 
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be 
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "inner.h"
+
+/* see inner.h */
+uint32_t
+br_rsa_pkcs1_sig_pad(const unsigned char *hash_oid,
+	const unsigned char *hash, size_t hash_len,
+	uint32_t n_bitlen, unsigned char *x)
+{
+	size_t u, x3, xlen;
+
+	/*
+	 * Padded hash value has format:
+	 *  00 01 FF .. FF 00 30 x1 30 x2 06 x3 OID 05 00 04 x4 HASH
+	 *
+	 * with the following rules:
+	 *
+	 *  -- Total length is equal to the modulus length (unsigned
+	 *     encoding).
+	 *
+	 *  -- There must be at least eight bytes of value 0xFF.
+	 *
+	 *  -- x4 is equal to the hash length (hash_len).
+	 *
+	 *  -- x3 is equal to the encoded OID value length (hash_oid[0]).
+	 *
+	 *  -- x2 = x3 + 4.
+	 *
+	 *  -- x1 = x2 + x4 + 4 = x3 + x4 + 8.
+	 *
+	 * Note: the "05 00" is optional (signatures with and without
+	 * that sequence exist in practice), but notes in PKCS#1 seem to
+	 * indicate that the presence of that sequence (specifically,
+	 * an ASN.1 NULL value for the hash parameters) may be slightly
+	 * more "standard" than the opposite.
+	 */
+	xlen = (n_bitlen + 7) >> 3;
+
+	if (hash_oid == NULL) {
+		if (xlen < hash_len + 11) {
+			return 0;
+		}
+		x[0] = 0x00;
+		x[1] = 0x01;
+		u = xlen - hash_len;
+		memset(x + 2, 0xFF, u - 3);
+		x[u - 1] = 0x00;
+	} else {
+		x3 = hash_oid[0];
+
+		/*
+		 * Check that there is enough room for all the elements,
+		 * including at least eight bytes of value 0xFF.
+		 */
+		if (xlen < (x3 + hash_len + 21)) {
+			return 0;
+		}
+		x[0] = 0x00;
+		x[1] = 0x01;
+		u = xlen - x3 - hash_len - 11;
+		memset(x + 2, 0xFF, u - 2);
+		x[u] = 0x00;
+		x[u + 1] = 0x30;
+		x[u + 2] = x3 + hash_len + 8;
+		x[u + 3] = 0x30;
+		x[u + 4] = x3 + 4;
+		x[u + 5] = 0x06;
+		memcpy(x + u + 6, hash_oid, x3 + 1);
+		u += x3 + 7;
+		x[u ++] = 0x05;
+		x[u ++] = 0x00;
+		x[u ++] = 0x04;
+		x[u ++] = hash_len;
+	}
+	memcpy(x + u, hash, hash_len);
+	return 1;
+}

package/guests/es256-rustcrypto/source/build.rs

@@ -0,0 +1,38 @@
+use std::{env, fs, path::PathBuf, process::Command};
+
+fn run(command: &mut Command) {
+    assert!(command.status().expect("C toolchain invocation failed").success(), "C toolchain failed");
+}
+
+fn main() {
+    let zig = env::var("PULSE_RSA_ZIG").expect("PULSE_RSA_ZIG must select pinned Zig 0.13.0");
+    let version = Command::new(&zig).arg("version").output().expect("Zig unavailable");
+    assert!(version.status.success());
+    assert_eq!(String::from_utf8(version.stdout).unwrap().trim(), "0.13.0");
+    let out = PathBuf::from(env::var_os("OUT_DIR").unwrap());
+    let mut sources = vec![PathBuf::from("rs256.c")];
+    for dir in ["bearssl/src/int", "bearssl/src/rsa", "bearssl/src/codec"] {
+        for entry in fs::read_dir(dir).unwrap() {
+            let path = entry.unwrap().path();
+            if path.extension().is_some_and(|ext| ext == "c") { sources.push(path); }
+        }
+    }
+    sources.sort();
+    let mut objects = Vec::new();
+    for (index, source) in sources.iter().enumerate() {
+        let object = out.join(format!("rsa-{index}.o"));
+        run(Command::new(&zig).args(["cc", "-target", "wasm32-freestanding", "-mcpu=mvp",
+            "-Oz", "-std=c99", "-ffreestanding", "-fno-builtin", "-fvisibility=hidden",
+            "-I", "freestanding", "-I", "bearssl/inc", "-I", "bearssl/src", "-c"])
+            .arg(source).arg("-o").arg(&object));
+        objects.push(object);
+    }
+    let archive = out.join("libpulse_rsa.a");
+    run(Command::new(&zig).args(["ar", "rcs"]).arg(&archive).args(objects));
+    println!("cargo:rustc-link-search=native={}", out.display());
+    println!("cargo:rustc-link-lib=static=pulse_rsa");
+    println!("cargo:rerun-if-env-changed=PULSE_RSA_ZIG");
+    println!("cargo:rerun-if-changed=rs256.c");
+    println!("cargo:rerun-if-changed=bearssl");
+    println!("cargo:rerun-if-changed=freestanding");
+}

package/guests/es256-rustcrypto/source/freestanding/string.h

@@ -0,0 +1,8 @@
+#ifndef PULSE_STRING_H
+#define PULSE_STRING_H
+#include <stddef.h>
+void *memcpy(void *, const void *, size_t);
+void *memmove(void *, const void *, size_t);
+void *memset(void *, int, size_t);
+int memcmp(const void *, const void *, size_t);
+#endif

package/guests/es256-rustcrypto/source/rs256.c

@@ -0,0 +1,103 @@
+/* Pulse RS256 adapter. RSA arithmetic is BearSSL 0.6's unmodified i31 code.
+ * Wire: LE32(k), n[k], e[4], then d[k], p/q/dp/dq/qi[k/2] for signing.
+ * All integers are unsigned big endian. Only balanced 2048/3072/4096 keys.
+ * No allocation, entropy, host callbacks, or retained pointers.
+ */
+#include "inner.h"
+
+#define WORDS 136
+static const unsigned char sha256_oid[] = {9, 0x60, 0x86, 0x48, 1, 0x65, 3, 4, 2, 1};
+
+static uint32_t equal(const unsigned char *a, const unsigned char *b, size_t n) {
+    uint32_t diff = 0;
+    for (size_t i = 0; i < n; i++) diff |= a[i] ^ b[i];
+    return EQ(diff, 0);
+}
+
+/* Use the declared fixed width, including for secret exponents. BearSSL's
+ * arithmetic lengths must not depend on their leading zero bits. */
+static void decode(uint32_t *a, const unsigned char *p, size_t n) {
+    memset(a, 0, WORDS * sizeof *a);
+    br_i31_decode(a, p, n);
+    a[0] = (uint32_t)((n * 8 / 31) * 32 + n * 8 % 31);
+}
+
+static uint32_t reduced_equal(const uint32_t *a, const uint32_t *m,
+    const unsigned char *expected, size_t n) {
+    uint32_t r[WORDS] = {0};
+    unsigned char encoded[512];
+    br_i31_reduce(r, a, m);
+    br_i31_encode(encoded, n, r);
+    return equal(encoded, expected, n);
+}
+
+/* Check n=p*q, d mod (p-1)=dp, d mod (q-1)=dq,
+ * e*dp=1 mod (p-1), e*dq=1 mod (q-1), and q*qi=1 mod p.
+ * These are consistency checks, not a primality proof/key generation API.
+ * Factors have a fixed public width and top bit; no variable-time inverse. */
+static uint32_t private_valid(const unsigned char *key, size_t k) {
+    const size_t h = k / 2;
+    const unsigned char *n = key + 4, *e = n + k, *d = e + 4;
+    const unsigned char *p = d + k, *q = p + h, *dp = q + h;
+    const unsigned char *dq = dp + h, *qi = dq + h;
+    uint32_t a[WORDS], b[WORDS], product[WORDS], m[WORDS], one[WORDS];
+    unsigned char encoded[512], expected[256] = {0};
+    uint32_t ok = (p[0] >> 7) & (q[0] >> 7) & (p[h-1] & q[h-1] & 1);
+    ok &= 1 ^ equal(p, q, h);
+    decode(a, p, h); decode(b, q, h);
+    memset(product, 0, sizeof product); product[0] = a[0];
+    br_i31_mulacc(product, a, b); br_i31_encode(encoded, k, product);
+    ok &= equal(encoded, n, k);
+    decode(a, d, k); decode(m, n, k);
+    ok &= br_i31_sub(a, m, 0);
+    for (size_t i = 0; i < 2; i++) {
+        decode(m, i == 0 ? p : q, h);
+        memset(one, 0, sizeof one); one[0] = m[0]; one[1] = 1;
+        br_i31_sub(m, one, 1);
+        decode(a, d, k);
+        ok &= reduced_equal(a, m, i == 0 ? dp : dq, h);
+        decode(a, i == 0 ? dp : dq, h); decode(b, e, 4);
+        memset(product, 0, sizeof product); product[0] = a[0];
+        br_i31_mulacc(product, a, b);
+        expected[h-1] = 1;
+        ok &= reduced_equal(product, m, expected, h);
+    }
+    decode(m, p, h); decode(a, q, h); decode(b, qi, h);
+    /* qi must be the canonical residue, not qi+p. */
+    ok &= br_i31_sub(b, m, 0);
+    memset(product, 0, sizeof product); product[0] = a[0];
+    br_i31_mulacc(product, a, b);
+    ok &= reduced_equal(product, m, expected, h);
+    return ok;
+}
+
+static uint32_t public_valid(const unsigned char *key, size_t k) {
+    const unsigned char *e = key + 4 + k;
+    uint32_t exponent = br_dec32be(e);
+    return (key[4] >> 7) & (key[3+k] & 1) & (exponent & 1) & GT(exponent, 2);
+}
+
+int pulse_rs256(const unsigned char *key, size_t key_len, const unsigned char *hash,
+    unsigned char *signature, size_t k, int sign) {
+    if (!(k == 256 || k == 384 || k == 512)
+        || key_len != (sign ? 8 + k * 9 / 2 : 8 + k)
+        || br_dec32le(key) != k || !public_valid(key, k)) return -1;
+    unsigned char expected[512], actual[512];
+    br_rsa_public_key pk = {(unsigned char *)key + 4, k, (unsigned char *)key + 4 + k, 4};
+    if (!br_rsa_pkcs1_sig_pad(sha256_oid, hash, 32, (uint32_t)k * 8, expected)) return -2;
+    if (sign) {
+        if (!private_valid(key, k)) return -1;
+        const size_t h = k / 2;
+        unsigned char *p = (unsigned char *)key + 8 + 2*k;
+        br_rsa_private_key sk = {(uint32_t)k*8, p, h, p+h, h, p+2*h, h, p+3*h, h, p+4*h, h};
+        memcpy(actual, expected, k);
+        if (!br_rsa_i31_private(actual, &sk)) return -1;
+        memcpy(signature, actual, k);
+    } else memcpy(actual, signature, k);
+    /* Exact EMSA-PKCS1-v1_5 encoding, including NULL AlgorithmIdentifier.
+     * Also a fault/CRT check before any private result is released. */
+    uint32_t ok = br_rsa_i31_public(actual, k, &pk);
+    ok &= equal(actual, expected, k);
+    if (sign && !ok) { memset(signature, 0, k); return -1; }
+    return (int)ok;
+}

package/guests/es256-rustcrypto/source/rust-toolchain.toml

@@ -0,0 +1,5 @@
+[toolchain]
+channel = "1.97.1"
+components = []
+profile = "minimal"
+targets = ["wasm32v1-none"]