277 lines
8.2 KiB
JavaScript
277 lines
8.2 KiB
JavaScript
|
/**
|
||
|
|
* Partial implementation of PKCS#1 v2.2: RSA-OEAP
|
||
|
|
*
|
||
|
|
* Modified but based on the following MIT and BSD licensed code:
|
||
|
|
*
|
||
|
|
* https://github.com/kjur/jsjws/blob/master/rsa.js:
|
||
|
|
*
|
||
|
|
* The 'jsjws'(JSON Web Signature JavaScript Library) License
|
||
|
|
*
|
||
|
|
* Copyright (c) 2012 Kenji Urushima
|
||
|
|
*
|
||
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||
|
|
* of this software and associated documentation files (the "Software"), to deal
|
||
|
|
* in the Software without restriction, including without limitation the rights
|
||
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||
|
|
* copies of the Software, and to permit persons to whom the Software is
|
||
|
|
* furnished to do so, subject to the following conditions:
|
||
|
|
*
|
||
|
|
* The above copyright notice and this permission notice shall be included in
|
||
|
|
* all copies or substantial portions of the Software.
|
||
|
|
*
|
||
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||
|
|
* THE SOFTWARE.
|
||
|
|
*
|
||
|
|
* http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain:
|
||
|
|
*
|
||
|
|
* RSAES-OAEP.js
|
||
|
|
* $Id: RSAES-OAEP.js,v 1.1.1.1 2003/03/19 15:37:20 ellispritchard Exp $
|
||
|
|
* JavaScript Implementation of PKCS #1 v2.1 RSA CRYPTOGRAPHY STANDARD (RSA Laboratories, June 14, 2002)
|
||
|
|
* Copyright (C) Ellis Pritchard, Guardian Unlimited 2003.
|
||
|
|
* Contact: ellis@nukinetics.com
|
||
|
|
* Distributed under the BSD License.
|
||
|
|
*
|
||
|
|
* Official documentation: http://www.rsa.com/rsalabs/node.asp?id=2125
|
||
|
|
*
|
||
|
|
* @author Evan Jones (http://evanjones.ca/)
|
||
|
|
* @author Dave Longley
|
||
|
|
*
|
||
|
|
* Copyright (c) 2013-2014 Digital Bazaar, Inc.
|
||
|
|
*/
|
||
|
|
var forge = require('./forge');
|
||
|
|
require('./util');
|
||
|
|
require('./random');
|
||
|
|
require('./sha1');
|
||
|
|
|
||
|
|
// shortcut for PKCS#1 API
|
||
|
|
var pkcs1 = module.exports = forge.pkcs1 = forge.pkcs1 || {};
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Encode the given RSAES-OAEP message (M) using key, with optional label (L)
|
||
|
|
* and seed.
|
||
|
|
*
|
||
|
|
* This method does not perform RSA encryption, it only encodes the message
|
||
|
|
* using RSAES-OAEP.
|
||
|
|
*
|
||
|
|
* @param key the RSA key to use.
|
||
|
|
* @param message the message to encode.
|
||
|
|
* @param options the options to use:
|
||
|
|
* label an optional label to use.
|
||
|
|
* seed the seed to use.
|
||
|
|
* md the message digest object to use, undefined for SHA-1.
|
||
|
|
* mgf1 optional mgf1 parameters:
|
||
|
|
* md the message digest object to use for MGF1.
|
||
|
|
*
|
||
|
|
* @return the encoded message bytes.
|
||
|
|
*/
|
||
|
|
pkcs1.encode_rsa_oaep = function(key, message, options) {
|
||
|
|
// parse arguments
|
||
|
|
var label;
|
||
|
|
var seed;
|
||
|
|
var md;
|
||
|
|
var mgf1Md;
|
||
|
|
// legacy args (label, seed, md)
|
||
|
|
if(typeof options === 'string') {
|
||
|
|
label = options;
|
||
|
|
seed = arguments[3] || undefined;
|
||
|
|
md = arguments[4] || undefined;
|
||
|
|
} else if(options) {
|
||
|
|
label = options.label || undefined;
|
||
|
|
seed = options.seed || undefined;
|
||
|
|
md = options.md || undefined;
|
||
|
|
if(options.mgf1 && options.mgf1.md) {
|
||
|
|
mgf1Md = options.mgf1.md;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// default OAEP to SHA-1 message digest
|
||
|
|
if(!md) {
|
||
|
|
md = forge.md.sha1.create();
|
||
|
|
} else {
|
||
|
|
md.start();
|
||
|
|
}
|
||
|
|
|
||
|
|
// default MGF-1 to same as OAEP
|
||
|
|
if(!mgf1Md) {
|
||
|
|
mgf1Md = md;
|
||
|
|
}
|
||
|
|
|
||
|
|
// compute length in bytes and check output
|
||
|
|
var keyLength = Math.ceil(key.n.bitLength() / 8);
|
||
|
|
var maxLength = keyLength - 2 * md.digestLength - 2;
|
||
|
|
if(message.length > maxLength) {
|
||
|
|
var error = new Error('RSAES-OAEP input message length is too long.');
|
||
|
|
error.length = message.length;
|
||
|
|
error.maxLength = maxLength;
|
||
|
|
throw error;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!label) {
|
||
|
|
label = '';
|
||
|
|
}
|
||
|
|
md.update(label, 'raw');
|
||
|
|
var lHash = md.digest();
|
||
|
|
|
||
|
|
var PS = '';
|
||
|
|
var PS_length = maxLength - message.length;
|
||
|
|
for(var i = 0; i < PS_length; i++) {
|
||
|
|
PS += '\x00';
|
||
|
|
}
|
||
|
|
|
||
|
|
var DB = lHash.getBytes() + PS + '\x01' + message;
|
||
|
|
|
||
|
|
if(!seed) {
|
||
|
|
seed = forge.random.getBytes(md.digestLength);
|
||
|
|
} else if(seed.length !== md.digestLength) {
|
||
|
|
var error = new Error('Invalid RSAES-OAEP seed. The seed length must ' +
|
||
|
|
'match the digest length.');
|
||
|
|
error.seedLength = seed.length;
|
||
|
|
error.digestLength = md.digestLength;
|
||
|
|
throw error;
|
||
|
|
}
|
||
|
|
|
||
|
|
var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, mgf1Md);
|
||
|
|
var maskedDB = forge.util.xorBytes(DB, dbMask, DB.length);
|
||
|
|
|
||
|
|
var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
|
||
|
|
var maskedSeed = forge.util.xorBytes(seed, seedMask, seed.length);
|
||
|
|
|
||
|
|
// return encoded message
|
||
|
|
return '\x00' + maskedSeed + maskedDB;
|
||
|
|
};
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Decode the given RSAES-OAEP encoded message (EM) using key, with optional
|
||
|
|
* label (L).
|
||
|
|
*
|
||
|
|
* This method does not perform RSA decryption, it only decodes the message
|
||
|
|
* using RSAES-OAEP.
|
||
|
|
*
|
||
|
|
* @param key the RSA key to use.
|
||
|
|
* @param em the encoded message to decode.
|
||
|
|
* @param options the options to use:
|
||
|
|
* label an optional label to use.
|
||
|
|
* md the message digest object to use for OAEP, undefined for SHA-1.
|
||
|
|
* mgf1 optional mgf1 parameters:
|
||
|
|
* md the message digest object to use for MGF1.
|
||
|
|
*
|
||
|
|
* @return the decoded message bytes.
|
||
|
|
*/
|
||
|
|
pkcs1.decode_rsa_oaep = function(key, em, options) {
|
||
|
|
// parse args
|
||
|
|
var label;
|
||
|
|
var md;
|
||
|
|
var mgf1Md;
|
||
|
|
// legacy args
|
||
|
|
if(typeof options === 'string') {
|
||
|
|
label = options;
|
||
|
|
md = arguments[3] || undefined;
|
||
|
|
} else if(options) {
|
||
|
|
label = options.label || undefined;
|
||
|
|
md = options.md || undefined;
|
||
|
|
if(options.mgf1 && options.mgf1.md) {
|
||
|
|
mgf1Md = options.mgf1.md;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// compute length in bytes
|
||
|
|
var keyLength = Math.ceil(key.n.bitLength() / 8);
|
||
|
|
|
||
|
|
if(em.length !== keyLength) {
|
||
|
|
var error = new Error('RSAES-OAEP encoded message length is invalid.');
|
||
|
|
error.length = em.length;
|
||
|
|
error.expectedLength = keyLength;
|
||
|
|
throw error;
|
||
|
|
}
|
||
|
|
|
||
|
|
// default OAEP to SHA-1 message digest
|
||
|
|
if(md === undefined) {
|
||
|
|
md = forge.md.sha1.create();
|
||
|
|
} else {
|
||
|
|
md.start();
|
||
|
|
}
|
||
|
|
|
||
|
|
// default MGF-1 to same as OAEP
|
||
|
|
if(!mgf1Md) {
|
||
|
|
mgf1Md = md;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(keyLength < 2 * md.digestLength + 2) {
|
||
|
|
throw new Error('RSAES-OAEP key is too short for the hash function.');
|
||
|
|
}
|
||
|
|
|
||
|
|
if(!label) {
|
||
|
|
label = '';
|
||
|
|
}
|
||
|
|
md.update(label, 'raw');
|
||
|
|
var lHash = md.digest().getBytes();
|
||
|
|
|
||
|
|
// split the message into its parts
|
||
|
|
var y = em.charAt(0);
|
||
|
|
var maskedSeed = em.substring(1, md.digestLength + 1);
|
||
|
|
var maskedDB = em.substring(1 + md.digestLength);
|
||
|
|
|
||
|
|
var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
|
||
|
|
var seed = forge.util.xorBytes(maskedSeed, seedMask, maskedSeed.length);
|
||
|
|
|
||
|
|
var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, mgf1Md);
|
||
|
|
var db = forge.util.xorBytes(maskedDB, dbMask, maskedDB.length);
|
||
|
|
|
||
|
|
var lHashPrime = db.substring(0, md.digestLength);
|
||
|
|
|
||
|
|
// constant time check that all values match what is expected
|
||
|
|
var error = (y !== '\x00');
|
||
|
|
|
||
|
|
// constant time check lHash vs lHashPrime
|
||
|
|
for(var i = 0; i < md.digestLength; ++i) {
|
||
|
|
error |= (lHash.charAt(i) !== lHashPrime.charAt(i));
|
||
|
|
}
|
||
|
|
|
||
|
|
// "constant time" find the 0x1 byte separating the padding (zeros) from the
|
||
|
|
// message
|
||
|
|
// TODO: It must be possible to do this in a better/smarter way?
|
||
|
|
var in_ps = 1;
|
||
|
|
var index = md.digestLength;
|
||
|
|
for(var j = md.digestLength; j < db.length; j++) {
|
||
|
|
var code = db.charCodeAt(j);
|
||
|
|
|
||
|
|
var is_0 = (code & 0x1) ^ 0x1;
|
||
|
|
|
||
|
|
// non-zero if not 0 or 1 in the ps section
|
||
|
|
var error_mask = in_ps ? 0xfffe : 0x0000;
|
||
|
|
error |= (code & error_mask);
|
||
|
|
|
||
|
|
// latch in_ps to zero after we find 0x1
|
||
|
|
in_ps = in_ps & is_0;
|
||
|
|
index += in_ps;
|
||
|
|
}
|
||
|
|
|
||
|
|
if(error || db.charCodeAt(index) !== 0x1) {
|
||
|
|
throw new Error('Invalid RSAES-OAEP padding.');
|
||
|
|
}
|
||
|
|
|
||
|
|
return db.substring(index + 1);
|
||
|
|
};
|
||
|
|
|
||
|
|
function rsa_mgf1(seed, maskLength, hash) {
|
||
|
|
// default to SHA-1 message digest
|
||
|
|
if(!hash) {
|
||
|
|
hash = forge.md.sha1.create();
|
||
|
|
}
|
||
|
|
var t = '';
|
||
|
|
var count = Math.ceil(maskLength / hash.digestLength);
|
||
|
|
for(var i = 0; i < count; ++i) {
|
||
|
|
var c = String.fromCharCode(
|
||
|
|
(i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF);
|
||
|
|
hash.start();
|
||
|
|
hash.update(seed + c);
|
||
|
|
t += hash.digest().getBytes();
|
||
|
|
}
|
||
|
|
return t.substring(0, maskLength);
|
||
|
|
}
|