PKCS#1 v2.2: RSA OAEP for forge. #45

evanj · Jun 22, 2013

This is a bit rough; I just copied-and-pasted this from my own project, and attempted to fit it into Forge where appropriate. Comments welcomed! Even better would be a careful review. There may be bugs still here, but I have been using it in an application that interoperates with output from Java, so it seems to "work". I hope!

Fixes issue #20

michenriksen · Jun 23, 2013

Would it make sense to move this to forge.util?

dlongley · Jun 23, 2013

An optimized version of this function already exists in forge.util. When I merge in this pull request I'll reuse it.

michenriksen · Jun 23, 2013

I think it would be a good idea to add a test where the message contains a leading \x00 byte. It seems to be a common mistake when implementing OAEP to be too greedy with trimming and therefore the unpadding will fail.

This implementation doesn't seem to have this problem, but it might be a good idea to add it anyway if someone introduces the problem in the future. :)

dlongley · Jun 23, 2013

It will take me a little time to merge this in because I'd like to integrate it with the existing API. I'll probably make it so that you can specify the padding via a string identifier in rsa.encrypt/rsa.decrypt -- as an additional way to use those functions.

evanj · Jun 24, 2013

I just push commit e5e43bd to use forge.util.xorBytes and commit 8b30497 to add a test for a message with zero bytes. Any other feedback is welcomed!

I think it makes a lot of sense to integrate this into the existing RSA API in some way. If you can describe what you would like, I could take a first cut at it. Although it may be "simple" enough that you could just do it yourself faster?

dlongley · Jun 24, 2013

I think it makes a lot of sense to integrate this into the existing RSA API in some way. If you can describe what you would like, I could take a first cut at it. Although it may be "simple" enough that you could just do it yourself faster?

@evanj, I've got an idea for how to do it fairly quickly without causing too many problems any legacy code (hopefully). I'll take care of it, but thanks for the offer!

dlongley · Jun 24, 2013

Thanks @evanj!

The integration is a bit messy for now, but the API is simple enough and shouldn't break existing use. I'm not that concerned about it because what I would ultimately like to do is transition over to using the WebCrypto API (so forge can be used as a polyfill). That's off in future land though.

I added an example of using RSAES-OAEP to the README.

dlongley · Jun 28, 2013

This closes #20.

michenriksen · Jun 23, 2013

I think it would be a good idea to add a test where the message contains a leading \x00 byte. It seems to be a common mistake when implementing OAEP to be too greedy with trimming and therefore the unpadding will fail.

This implementation doesn't seem to have this problem, but it might be a good idea to add it anyway if someone introduces the problem in the future. :)

evanj forge.pkcs1: Implementation of RSA-OAEP using Forge. …
nodejs-pkcs1.js: Test the implementation using RSA's test vectors.
8ed779f

dlongley merged commit 8b30497 into digitalbazaar:master Jun 24, 2013

@@ ((118 lines not shown)) @@
+    +    // non-zero if not 0 or 1 in the ps section
+    +    var error_mask = in_ps ? 0xfffe : 0x0000;
+    +    error |= (code & error_mask);
+    +
+    +    // latch in_ps to zero after we find 0x1
+    +    in_ps = in_ps & is_0;
+    +    index += in_ps;
+    +  }
+    +
+    +  if (error || db.charCodeAt(index) != 0x1) {
+    +    throw new Error("Decryption error: invalid padding");
+    +  }
+    +  return db.substring(index + 1);
+    +};
+    +
+    +function xorString(string1, string2) {

@@ ((573 lines not shown)) @@
+    +  seed = 'XKymoPdkFhqWhPhdkrbg7zfKi2U=';
+    +  encrypted = 'Yxjp+1wNBeUwfhaDQ26QMpOsRkI1iqoiPXFjATq6h+Lf2o5gxoYOKaHpJoYWPqC5F18ynKOxMaHt06d3Wai5e61qT49DlvKM9vOcpYES5IFg1uID2qWFbzrKX/7Vd69JlAjj39Iz4+YE2+NKnEyQgt5lUnysYzHSncgOBQig+nEi5/Mp9sylz6NNTR2kF4BUV+AIvsVJ5Hj/nhKnY8R30Vu7ePW2m9V4MPwsTtaG15vHKpXYX4gTTGsK/laozPvIVYKLszm9F5Cc8dcN4zNa4HA5CT5gbWVTZd5lULhyzW3h1EDuAxthlF9imtijU7DUCTnpajxFDSqNXu6fZ4CTyA==';
+    +  checkOAEPEncrypt(pubkey, privateKey, message, seed, encrypted);
+    +
+    +  // RSAES-OAEP Encryption Example 10.5
+    +  message = 'p91sfcJLRvndXx6RraTDs9+UfodyMqk=';
+    +  seed = 'lbyp44WYlLPdhp+n7NW7xkAb8+Q=';
+    +  encrypted = 'dSkIcsz9SkUFZg1lH1babaoJyhMB2JBjL2qZLz1WXO5GSv3tQO07W+k1ZxTqWqdlX0oTZsLxfHKPbyxaXR+OKEKbxOb48s/42o3A4KmAjkX9CeovpAyyts5v//XA4VnRG2jZCoX3uE4QOwnmgmZkgMZXUFwJKSWUaKMUeG106rExVzzyNL9X232eZsxnSBkuAC3A3uqTBYXwgx/c2bwz1R957S/8Frz01ZgS/OvKo/kGmw5EVobWRMJcz2O0Vu5fpv/pbxnN91H+2erzWVd1Tb9L/qUhaqGETcUHyy0IDnIuuhUDCMK1/xGTYg8XZuz0SBuvuUO9KSh38hNspJSroA==';
+    +  checkOAEPEncrypt(pubkey, privateKey, message, seed, encrypted);
+    +
+    +  // RSAES-OAEP Encryption Example 10.6
+    +  message = '6vGnOhsMRglTfeac2SKLvPuajKjGw++vBW/kp/RjTtALfDnsaSLXuOosBOus';
+    +  seed = 'n0fd9C6X7qhWqb28cU6zrCL26zI=';
+    +  encrypted = 'LSB6c0Mqj7TAMFGz9zsophdkCY36NMR6IJlfgRWqaBZnm1V+gtvuWEkIxuaXgtfes029Za8GPVf8p2pf0GlJL9YGjZmE0gk1BWWmLlx38jA4wSyxDGY0cJtUfEb2tKcJvYXKEi10Rl75d2LCl2Pgbbx6nnOMeL/KAQLcXnnWW5c/KCQMqrLhYaeLV9JiRX7YGV1T48eunaAhiDxtt8JK/dIyLqyXKtPDVMX87x4UbDoCkPtnrfAHBm4AQo0s7BjOWPkyhpje/vSy617HaRj94cGYy7OLevxnYmqa7+xDIr/ZDSVjSByaIh94yCcsgtG2KrkU4cafavbvMMpSYNtKRg==';
+    +  checkOAEPEncrypt(pubkey, privateKey, message, seed, encrypted);
+    +}

@@ @@ -16,6 +16,7 @@ var deps = [ @@
        './log',
        './pbkdf2',
        './pkcs7',
+    +  './pkcs1',
        './pkcs12',
        './pki',
        './prng',

@@ -0,0 +1,194 @@
+    +/**
+    + * Partial implementation of PKCS#1 v2.2: RSA-OEAP
+    + *
+    + * Modified but based on the following MIT and BSD licensed code:
+    + * https://github.com/kjur/jsjws/blob/master/rsa.js
+    + * http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain
+    +
+    + * Official documentation: http://www.rsa.com/rsalabs/node.asp?id=2125
+    + */
+    +(function() {
+    +/* ########## Begin module implementation ########## */
+    +function initModule(forge) {
+    +
+    +// shortcut for PKCS#12 API
+    +var pkcs1 = forge.pkcs1 = forge.pkcs1 || {};
+    +
+    +/**
+    + * RSAES-OAEP-ENCRYPT message (M) using key, with optional label (L) and seed.
+    + */
+    +pkcs1.rsa_oaep_encrypt = function(key, message, label, seed) {
+    +  // hash function hard-coded to SHA-1
+    +  var md = forge.md.sha1.create();
+    +
+    +  // compute length in bytes and check output
+    +  var keyLength = Math.ceil(key.n.bitLength() / 8);
+    +  var maxLength = keyLength - 2 * md.digestLength - 2;
+    +  if (message.length > maxLength) {
+    +    throw new Error("input message too long (max: " + maxLength +
+    +        " message: " + message.length + ")");
+    +  }
+    +
+    +  if (!label) label = '';
+    +  md.update(label);
+    +  var lHash = md.digest();
+    +
+    +  var PS = '';
+    +  var PS_length = maxLength - message.length;
+    +  for (var i = 0; i < PS_length; i++) {
+    +    PS += '\x00';
+    +  }
+    +
+    +  var DB = lHash.getBytes() + PS + '\x01' + message;
+    +
+    +  if (!seed) {
+    +    seed = forge.random.getBytes(md.digestLength);
+    +  } else if (seed.length != md.digestLength) {
+    +    throw new Error("Invalid seed");
+    +  }
+    +
+    +  var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, md);
+    +  var maskedDB = forge.util.xorBytes(DB, dbMask, DB.length);
+    +
+    +  var seedMask = rsa_mgf1(maskedDB, md.digestLength, md);
+    +  var maskedSeed = forge.util.xorBytes(seed, seedMask, seed.length);
+    +
+    +  var EM = '\x00' + maskedSeed + maskedDB;
+    +
+    +  // true = public key; do not pad
+    +  var C = forge.pki.rsa.encrypt(EM, key, true);
+    +  return C;
+    +};
+    +
+    +/**
+    + * RSAES-OAEP-DECRYPT ciphertext (C) using key, with optional label (L).
+    + */
+    +pkcs1.rsa_oaep_decrypt = function(key, ciphertext, label) {
+    +  // compute length in bytes and check output
+    +  var keyLength = Math.ceil(key.n.bitLength() / 8);
+    +
+    +  if (ciphertext.length != keyLength) {
+    +    throw new Error('Decryption error: invalid ciphertext length');
+    +  }
+    +
+    +  // hash function hard-coded to SHA-1
+    +  var md = forge.md.sha1.create();
+    +
+    +  if (keyLength < 2 * md.digestLength + 2) {
+    +    throw new Error('Decryption error: key too short for the hash function');
+    +  }
+    +
+    +  // false = private key operation; false = no padding
+    +  var EM = forge.pki.rsa.decrypt(ciphertext, key, false, false);
+    +
+    +  if (!label) label = '';
+    +  md.update(label);
+    +  var lHash = md.digest().getBytes();
+    +
+    +  // Split the message into its parts
+    +  var y = EM.charAt(0);
+    +  var maskedSeed = EM.substring(1, md.digestLength + 1);
+    +  var maskedDB = EM.substring(1 + md.digestLength);
+    +
+    +  var seedMask = rsa_mgf1(maskedDB, md.digestLength, md);
+    +  var seed = forge.util.xorBytes(maskedSeed, seedMask, maskedSeed.length);
+    +
+    +  var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, md);
+    +  var db = forge.util.xorBytes(maskedDB, dbMask, maskedDB.length);
+    +
+    +  var lHashPrime = db.substring(0, md.digestLength);
+    +
+    +  // constant time check that all values match what is expected
+    +  var error = y != '\x00';
+    +
+    +  // constant time check lHash vs lHashPrime
+    +  for (var i = 0; i < md.digestLength; i++) {
+    +    error |= (lHash.charAt(i) != lHashPrime.charAt(i));
+    +  }
+    +
+    +  // "Constant time" find the 0x1 byte separating the padding (zeros) from the message
+    +  // TODO: It must be possible to do this in a better/smarter way?
+    +  var in_ps = 1;
+    +  var index = md.digestLength;
+    +  for (var j = md.digestLength; j < db.length; j++) {
+    +    var code = db.charCodeAt(j);
+    +
+    +    var is_0 = (code & 0x1) ^ 0x1;
+    +
+    +    // non-zero if not 0 or 1 in the ps section
+    +    var error_mask = in_ps ? 0xfffe : 0x0000;
+    +    error |= (code & error_mask);
+    +
+    +    // latch in_ps to zero after we find 0x1
+    +    in_ps = in_ps & is_0;
+    +    index += in_ps;
+    +  }
+    +
+    +  if (error || db.charCodeAt(index) != 0x1) {
+    +    throw new Error("Decryption error: invalid padding");
+    +  }
+    +  return db.substring(index + 1);
+    +};
+    +
+    +function rsa_mgf1(seed, maskLength, hash) {
+    +  var t = '';
+    +  var count = Math.ceil(maskLength / hash.digestLength);
+    +  for (var i = 0; i < count; i++) {
+    +    var c = String.fromCharCode((i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF);
+    +    hash.start();
+    +    hash.update(seed + c);
+    +    t += hash.digest().getBytes();
+    +  }
+    +
+    +  return t.substring(0, maskLength);
+    +}
+    +
+    +} // end module implementation
+    +
+    +/* ########## Begin module wrapper ########## */
+    +var name = 'pkcs1';
+    +var deps = [
+    +  './random',
+    +  './rsa',
+    +  './sha1'
+    +];
+    +var nodeDefine = null;
+    +if(typeof define !== 'function') {
+    +  // NodeJS -> AMD
+    +  if(typeof module === 'object' && module.exports) {
+    +    nodeDefine = function(ids, factory) {
+    +      factory(require, module);
+    +    };
+    +  }
+    +  // <script>
+    +  else {
+    +    if(typeof forge === 'undefined') {
+    +      forge = {};
+    +    }
+    +    initModule(forge);
+    +  }
+    +}
+    +// AMD
+    +if(nodeDefine || typeof define === 'function') {
+    +  // define module AMD style
+    +  (nodeDefine || define)(['require', 'module'].concat(deps),
+    +  function(require, module) {
+    +    module.exports = function(forge) {
+    +      var mods = deps.map(function(dep) {
+    +        return require(dep);
+    +      }).concat(initModule);
+    +      // handle circular dependencies
+    +      forge = forge || {};
+    +      forge.defined = forge.defined || {};
+    +      if(forge.defined[name]) {
+    +        return forge[name];
+    +      }
+    +      forge.defined[name] = true;
+    +      for(var i = 0; i < mods.length; ++i) {
+    +        mods[i](forge);
+    +      }
+    +      return forge[name];
+    +    };
+    +  });
+    +}
+    +})();

digitalbazaar/forge

HTTPS clone URL

Subversion checkout URL

PKCS#1 v2.2: RSA OAEP for forge. #45

Labels

Milestone

Assignee

3 participants

		evanj	`pkcs1: Replace xorString using forge.util.xorBytes` … Removes assertions verifying that the two strings are the same length, but is otherwise equivalent.	`e5e43bd`
		evanj	`nodejs-pkcs1.js: Add test for zero byte message; Fix lint warnings.`	`8b30497`