visaljs 0.0.1 → 0.0.3

package/runtime/third_party/bearssl/src/rsa/rsa_i62_pss_sign.c

@@ -1,60 +0,0 @@
-/*
- * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#if BR_INT128 || BR_UMUL128
-
-/* see bearssl_rsa.h */
-uint32_t
-br_rsa_i62_pss_sign(const br_prng_class **rng,
-	const br_hash_class *hf_data, const br_hash_class *hf_mgf1,
-	const unsigned char *hash, size_t salt_len,
-	const br_rsa_private_key *sk, unsigned char *x)
-{
-	if (!br_rsa_pss_sig_pad(rng, hf_data, hf_mgf1, hash,
-		salt_len, sk->n_bitlen, x))
-	{
-		return 0;
-	}
-	return br_rsa_i62_private(x, sk);
-}
-
-/* see bearssl_rsa.h */
-br_rsa_pss_sign
-br_rsa_i62_pss_sign_get(void)
-{
-	return &br_rsa_i62_pss_sign;
-}
-
-#else
-
-/* see bearssl_rsa.h */
-br_rsa_pss_sign
-br_rsa_i62_pss_sign_get(void)
-{
-	return 0;
-}
-
-#endif

package/runtime/third_party/bearssl/src/rsa/rsa_i62_pss_vrfy.c

@@ -1,64 +0,0 @@
-/*
- * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#if BR_INT128 || BR_UMUL128
-
-/* see bearssl_rsa.h */
-uint32_t
-br_rsa_i62_pss_vrfy(const unsigned char *x, size_t xlen,
-	const br_hash_class *hf_data, const br_hash_class *hf_mgf1,
-	const void *hash, size_t salt_len, const br_rsa_public_key *pk)
-{
-	unsigned char sig[BR_MAX_RSA_SIZE >> 3];
-
-	if (xlen > (sizeof sig)) {
-		return 0;
-	}
-	memcpy(sig, x, xlen);
-	if (!br_rsa_i62_public(sig, xlen, pk)) {
-		return 0;
-	}
-	return br_rsa_pss_sig_unpad(hf_data, hf_mgf1,
-		hash, salt_len, pk, sig);
-}
-
-/* see bearssl_rsa.h */
-br_rsa_pss_vrfy
-br_rsa_i62_pss_vrfy_get(void)
-{
-	return &br_rsa_i62_pss_vrfy;
-}
-
-#else
-
-/* see bearssl_rsa.h */
-br_rsa_pss_vrfy
-br_rsa_i62_pss_vrfy_get(void)
-{
-	return 0;
-}
-
-#endif

package/runtime/third_party/bearssl/src/rsa/rsa_i62_pub.c

@@ -1,125 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#if BR_INT128 || BR_UMUL128
-
-/*
- * As a strict minimum, we need four buffers that can hold a
- * modular integer. But TLEN is expressed in 64-bit words.
- */
-#define TLEN   (2 * (2 + ((BR_MAX_RSA_SIZE + 30) / 31)))
-
-/* see bearssl_rsa.h */
-uint32_t
-br_rsa_i62_public(unsigned char *x, size_t xlen,
-	const br_rsa_public_key *pk)
-{
-	const unsigned char *n;
-	size_t nlen;
-	uint64_t tmp[TLEN];
-	uint32_t *m, *a;
-	size_t fwlen;
-	long z;
-	uint32_t m0i, r;
-
-	/*
-	 * Get the actual length of the modulus, and see if it fits within
-	 * our stack buffer. We also check that the length of x[] is valid.
-	 */
-	n = pk->n;
-	nlen = pk->nlen;
-	while (nlen > 0 && *n == 0) {
-		n ++;
-		nlen --;
-	}
-	if (nlen == 0 || nlen > (BR_MAX_RSA_SIZE >> 3) || xlen != nlen) {
-		return 0;
-	}
-	z = (long)nlen << 3;
-	fwlen = 1;
-	while (z > 0) {
-		z -= 31;
-		fwlen ++;
-	}
-	/*
-	 * Convert fwlen to a count in 62-bit words.
-	 */
-	fwlen = (fwlen + 1) >> 1;
-
-	/*
-	 * The modulus gets decoded into m[].
-	 * The value to exponentiate goes into a[].
-	 */
-	m = (uint32_t *)tmp;
-	a = (uint32_t *)(tmp + fwlen);
-
-	/*
-	 * Decode the modulus.
-	 */
-	br_i31_decode(m, n, nlen);
-	m0i = br_i31_ninv31(m[1]);
-
-	/*
-	 * Note: if m[] is even, then m0i == 0. Otherwise, m0i must be
-	 * an odd integer.
-	 */
-	r = m0i & 1;
-
-	/*
-	 * Decode x[] into a[]; we also check that its value is proper.
-	 */
-	r &= br_i31_decode_mod(a, x, xlen, m);
-
-	/*
-	 * Compute the modular exponentiation.
-	 */
-	br_i62_modpow_opt(a, pk->e, pk->elen, m, m0i,
-		tmp + 2 * fwlen, TLEN - 2 * fwlen);
-
-	/*
-	 * Encode the result.
-	 */
-	br_i31_encode(x, xlen, a);
-	return r;
-}
-
-/* see bearssl_rsa.h */
-br_rsa_public
-br_rsa_i62_public_get(void)
-{
-	return &br_rsa_i62_public;
-}
-
-#else
-
-/* see bearssl_rsa.h */
-br_rsa_public
-br_rsa_i62_public_get(void)
-{
-	return 0;
-}
-
-#endif

package/runtime/third_party/bearssl/src/rsa/rsa_oaep_pad.c

@@ -1,112 +0,0 @@
-/*
- * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/*
- * Hash some data. This is put as a separate function so that stack
- * allocation of the hash function context is done only for the duration
- * of the hash.
- */
-static void
-hash_data(const br_hash_class *dig, void *dst, const void *src, size_t len)
-{
-	br_hash_compat_context hc;
-
-	hc.vtable = dig;
-	dig->init(&hc.vtable);
-	dig->update(&hc.vtable, src, len);
-	dig->out(&hc.vtable, dst);
-}
-
-/* see inner.h */
-size_t
-br_rsa_oaep_pad(const br_prng_class **rnd, const br_hash_class *dig,
-	const void *label, size_t label_len,
-	const br_rsa_public_key *pk,
-	void *dst, size_t dst_max_len,
-	const void *src, size_t src_len)
-{
-	size_t k, hlen;
-	unsigned char *buf;
-
-	hlen = br_digest_size(dig);
-
-	/*
-	 * Compute actual modulus length (in bytes).
-	 */
-	k = pk->nlen;
-	while (k > 0 && pk->n[k - 1] == 0) {
-		k --;
-	}
-
-	/*
-	 * An error is reported if:
-	 *  - the modulus is too short;
-	 *  - the source message length is too long;
-	 *  - the destination buffer is too short.
-	 */
-	if (k < ((hlen << 1) + 2)
-		|| src_len > (k - (hlen << 1) - 2)
-		|| dst_max_len < k)
-	{
-		return 0;
-	}
-
-	/*
-	 * Apply padding. At this point, things cannot fail.
-	 */
-	buf = dst;
-
-	/*
-	 * Assemble: DB = lHash || PS || 0x01 || M
-	 * We first place the source message M with memmove(), so that
-	 * overlaps between source and destination buffers are supported.
-	 */
-	memmove(buf + k - src_len, src, src_len);
-	hash_data(dig, buf + 1 + hlen, label, label_len);
-	memset(buf + 1 + (hlen << 1), 0, k - src_len - (hlen << 1) - 2);
-	buf[k - src_len - 1] = 0x01;
-
-	/*
-	 * Make the random seed.
-	 */
-	(*rnd)->generate(rnd, buf + 1, hlen);
-
-	/*
-	 * Mask DB with the mask generated from the seed.
-	 */
-	br_mgf1_xor(buf + 1 + hlen, k - hlen - 1, dig, buf + 1, hlen);
-
-	/*
-	 * Mask the seed with the mask generated from the masked DB.
-	 */
-	br_mgf1_xor(buf + 1, hlen, dig, buf + 1 + hlen, k - hlen - 1);
-
-	/*
-	 * Padding result: EM = 0x00 || maskedSeed || maskedDB.
-	 */
-	buf[0] = 0x00;
-	return k;
-}

package/runtime/third_party/bearssl/src/rsa/rsa_oaep_unpad.c

@@ -1,145 +0,0 @@
-/*
- * Copyright (c) 2018 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/*
- * Hash some data and XOR the result into the provided buffer. This is put
- * as a separate function so that stack allocation of the hash function
- * context is done only for the duration of the hash.
- */
-static void
-xor_hash_data(const br_hash_class *dig, void *dst, const void *src, size_t len)
-{
-	br_hash_compat_context hc;
-	unsigned char tmp[64];
-	unsigned char *buf;
-	size_t u, hlen;
-
-	hc.vtable = dig;
-	dig->init(&hc.vtable);
-	dig->update(&hc.vtable, src, len);
-	dig->out(&hc.vtable, tmp);
-	buf = dst;
-	hlen = br_digest_size(dig);
-	for (u = 0; u < hlen; u ++) {
-		buf[u] ^= tmp[u];
-	}
-}
-
-/* see inner.h */
-uint32_t
-br_rsa_oaep_unpad(const br_hash_class *dig,
-	const void *label, size_t label_len,
-	void *data, size_t *len)
-{
-	size_t u, k, hlen;
-	unsigned char *buf;
-	uint32_t r, s, zlen;
-
-	hlen = br_digest_size(dig);
-	k = *len;
-	buf = data;
-
-	/*
-	 * There must be room for the padding.
-	 */
-	if (k < ((hlen << 1) + 2)) {
-		return 0;
-	}
-
-	/*
-	 * Unmask the seed, then the DB value.
-	 */
-	br_mgf1_xor(buf + 1, hlen, dig, buf + 1 + hlen, k - hlen - 1);
-	br_mgf1_xor(buf + 1 + hlen, k - hlen - 1, dig, buf + 1, hlen);
-
-	/*
-	 * Hash the label and XOR it with the value in the array; if
-	 * they are equal then these should yield only zeros.
-	 */
-	xor_hash_data(dig, buf + 1 + hlen, label, label_len);
-
-	/*
-	 * At that point, if the padding was correct, when we should
-	 * have: 0x00 || seed || 0x00 ... 0x00 0x01 || M
-	 * Padding is valid as long as:
-	 *  - There is at least hlen+1 leading bytes of value 0x00.
-	 *  - There is at least one non-zero byte.
-	 *  - The first (leftmost) non-zero byte has value 0x01.
-	 *
-	 * Ultimately, we may leak the resulting message length, i.e.
-	 * the position of the byte of value 0x01, but we must take care
-	 * to do so only if the number of zero bytes has been verified
-	 * to be at least hlen+1.
-	 *
-	 * The loop below counts the number of bytes of value 0x00, and
-	 * checks that the next byte has value 0x01, in constant-time.
-	 *
-	 *  - If the initial byte (before the seed) is not 0x00, then
-	 *    r and s are set to 0, and stay there.
-	 *  - Value r is 1 until the first non-zero byte is reached
-	 *    (after the seed); it switches to 0 at that point.
-	 *  - Value s is set to 1 if and only if the data encountered
-	 *    at the time of the transition of r from 1 to 0 has value
-	 *    exactly 0x01.
-	 *  - Value zlen counts the number of leading bytes of value zero
-	 *    (after the seed).
-	 */
-	r = 1 - ((buf[0] + 0xFF) >> 8);
-	s = 0;
-	zlen = 0;
-	for (u = hlen + 1; u < k; u ++) {
-		uint32_t w, nz;
-
-		w = buf[u];
-
-		/*
-		 * nz == 1 only for the first non-zero byte.
-		 */
-		nz = r & ((w + 0xFF) >> 8);
-		s |= nz & EQ(w, 0x01);
-		r &= NOT(nz);
-		zlen += r;
-	}
-
-	/*
-	 * Padding is correct only if s == 1, _and_ zlen >= hlen.
-	 */
-	s &= GE(zlen, (uint32_t)hlen);
-
-	/*
-	 * At that point, padding was verified, and we are now allowed
-	 * to make conditional jumps.
-	 */
-	if (s) {
-		size_t plen;
-
-		plen = 2 + hlen + zlen;
-		k -= plen;
-		memmove(buf, buf + plen, k);
-		*len = k;
-	}
-	return s;
-}

package/runtime/third_party/bearssl/src/rsa/rsa_pkcs1_sig_pad.c

@@ -1,100 +0,0 @@
-/*
- * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/* see inner.h */
-uint32_t
-br_rsa_pkcs1_sig_pad(const unsigned char *hash_oid,
-	const unsigned char *hash, size_t hash_len,
-	uint32_t n_bitlen, unsigned char *x)
-{
-	size_t u, x3, xlen;
-
-	/*
-	 * Padded hash value has format:
-	 *  00 01 FF .. FF 00 30 x1 30 x2 06 x3 OID 05 00 04 x4 HASH
-	 *
-	 * with the following rules:
-	 *
-	 *  -- Total length is equal to the modulus length (unsigned
-	 *     encoding).
-	 *
-	 *  -- There must be at least eight bytes of value 0xFF.
-	 *
-	 *  -- x4 is equal to the hash length (hash_len).
-	 *
-	 *  -- x3 is equal to the encoded OID value length (hash_oid[0]).
-	 *
-	 *  -- x2 = x3 + 4.
-	 *
-	 *  -- x1 = x2 + x4 + 4 = x3 + x4 + 8.
-	 *
-	 * Note: the "05 00" is optional (signatures with and without
-	 * that sequence exist in practice), but notes in PKCS#1 seem to
-	 * indicate that the presence of that sequence (specifically,
-	 * an ASN.1 NULL value for the hash parameters) may be slightly
-	 * more "standard" than the opposite.
-	 */
-	xlen = (n_bitlen + 7) >> 3;
-
-	if (hash_oid == NULL) {
-		if (xlen < hash_len + 11) {
-			return 0;
-		}
-		x[0] = 0x00;
-		x[1] = 0x01;
-		u = xlen - hash_len;
-		memset(x + 2, 0xFF, u - 3);
-		x[u - 1] = 0x00;
-	} else {
-		x3 = hash_oid[0];
-
-		/*
-		 * Check that there is enough room for all the elements,
-		 * including at least eight bytes of value 0xFF.
-		 */
-		if (xlen < (x3 + hash_len + 21)) {
-			return 0;
-		}
-		x[0] = 0x00;
-		x[1] = 0x01;
-		u = xlen - x3 - hash_len - 11;
-		memset(x + 2, 0xFF, u - 2);
-		x[u] = 0x00;
-		x[u + 1] = 0x30;
-		x[u + 2] = x3 + hash_len + 8;
-		x[u + 3] = 0x30;
-		x[u + 4] = x3 + 4;
-		x[u + 5] = 0x06;
-		memcpy(x + u + 6, hash_oid, x3 + 1);
-		u += x3 + 7;
-		x[u ++] = 0x05;
-		x[u ++] = 0x00;
-		x[u ++] = 0x04;
-		x[u ++] = hash_len;
-	}
-	memcpy(x + u, hash, hash_len);
-	return 1;
-}