Skip to content

Commit 3327d9a

Browse files
LinuxJediLinuxJedi
committed
Cleanup PSS constants and build
* Use constants from wolfSSL instead of copying them * Add build gate for PSS * Fix indentation
1 parent 501c269 commit 3327d9a

2 files changed

Lines changed: 110 additions & 79 deletions

File tree

‎wolfcrypt/_build_ffi.py‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ def generate_libwolfssl():
103103
ASN_ENABLED = 1
104104
WC_RNG_SEED_CB_ENABLED = 0
105105
AESGCM_STREAM = 1
106+
RSA_PSS_ENABLED = 1
106107

107108
# detect native features based on options.h defines
108109
if featureDetection:
@@ -128,6 +129,7 @@ def generate_libwolfssl():
128129
ASN_ENABLED = 0 if '#define NO_ASN' in optionsHeaderStr else 1
129130
WC_RNG_SEED_CB_ENABLED = 1 if '#define WC_RNG_SEED_CB' in optionsHeaderStr else 0
130131
AESGCM_STREAM = 1 if '#define WOLFSSL_AESGCM_STREAM' in optionsHeaderStr else 0
132+
RSA_PSS_ENABLED = 1 if '#define WC_RSA_PSS' in optionsHeaderStr else 0
131133

132134
if '#define HAVE_FIPS' in optionsHeaderStr:
133135
FIPS_ENABLED = 1
@@ -205,6 +207,7 @@ def generate_libwolfssl():
205207
int ASN_ENABLED = """ + str(ASN_ENABLED) + """;
206208
int WC_RNG_SEED_CB_ENABLED = """ + str(WC_RNG_SEED_CB_ENABLED) + """;
207209
int AESGCM_STREAM = """ + str(AESGCM_STREAM) + """;
210+
int RSA_PSS_ENABLED = """ + str(RSA_PSS_ENABLED) + """;
208211
""",
209212
include_dirs=[wolfssl_inc_path()],
210213
library_dirs=[wolfssl_lib_path()],
@@ -235,6 +238,7 @@ def generate_libwolfssl():
235238
extern int ASN_ENABLED;
236239
extern int WC_RNG_SEED_CB_ENABLED;
237240
extern int AESGCM_STREAM;
241+
extern int RSA_PSS_ENABLED;
238242
239243
typedef unsigned char byte;
240244
typedef unsigned int word32;
@@ -387,15 +391,47 @@ def generate_libwolfssl():
387391
int wc_RsaPrivateDecrypt_ex(const byte* in, word32 inLen,
388392
byte* out, word32 outLen, RsaKey* key, int type,
389393
enum wc_HashType hash, int mgf, byte* label, word32 labelSz);
390-
int wc_RsaPSS_Sign(const byte* in, word32 inLen, byte* out, word32 outLen,
391-
enum wc_HashType hash, int mgf, RsaKey* key, WC_RNG* rng);
392-
int wc_RsaPSS_Verify(byte* in, word32 inLen, byte* out, word32 outLen,
393-
enum wc_HashType hash, int mgf, RsaKey* key);
394-
int wc_RsaPSS_CheckPadding(const byte* in, word32 inSz, byte* sig,
395-
word32 sigSz, enum wc_HashType hashType);
396-
int wc_RsaSSL_Sign(const byte*, word32, byte*, word32, RsaKey*, WC_RNG*);
397-
int wc_RsaSSL_Verify(const byte*, word32, byte*, word32, RsaKey*);
398394
"""
395+
if RSA_PSS_ENABLED:
396+
_cdef += """
397+
static const int WC_RSA_PKCSV15_PAD;
398+
static const int WC_RSA_OAEP_PAD;
399+
static const int WC_RSA_PSS_PAD;
400+
static const int WC_RSA_NO_PAD;
401+
402+
static const int WC_MGF1NONE;
403+
static const int WC_MGF1SHA1;
404+
static const int WC_MGF1SHA224;
405+
static const int WC_MGF1SHA256;
406+
static const int WC_MGF1SHA384;
407+
static const int WC_MGF1SHA512;
408+
409+
static const int WC_HASH_TYPE_NONE;
410+
static const int WC_HASH_TYPE_MD2;
411+
static const int WC_HASH_TYPE_MD4;
412+
static const int WC_HASH_TYPE_MD5;
413+
static const int WC_HASH_TYPE_SHA;
414+
static const int WC_HASH_TYPE_SHA224;
415+
static const int WC_HASH_TYPE_SHA256;
416+
static const int WC_HASH_TYPE_SHA384;
417+
static const int WC_HASH_TYPE_SHA512;
418+
static const int WC_HASH_TYPE_MD5_SHA;
419+
static const int WC_HASH_TYPE_SHA3_224;
420+
static const int WC_HASH_TYPE_SHA3_256;
421+
static const int WC_HASH_TYPE_SHA3_384;
422+
static const int WC_HASH_TYPE_SHA3_512;
423+
static const int WC_HASH_TYPE_BLAKE2B;
424+
static const int WC_HASH_TYPE_BLAKE2S;
425+
426+
int wc_RsaPSS_Sign(const byte* in, word32 inLen, byte* out, word32 outLen,
427+
enum wc_HashType hash, int mgf, RsaKey* key, WC_RNG* rng);
428+
int wc_RsaPSS_Verify(byte* in, word32 inLen, byte* out, word32 outLen,
429+
enum wc_HashType hash, int mgf, RsaKey* key);
430+
int wc_RsaPSS_CheckPadding(const byte* in, word32 inSz, byte* sig,
431+
word32 sigSz, enum wc_HashType hashType);
432+
int wc_RsaSSL_Sign(const byte*, word32, byte*, word32, RsaKey*, WC_RNG*);
433+
int wc_RsaSSL_Verify(const byte*, word32, byte*, word32, RsaKey*);
434+
"""
399435

400436
if RSA_BLINDING_ENABLED:
401437
_cdef += """

‎wolfcrypt/ciphers.py‎

Lines changed: 66 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -82,37 +82,29 @@
8282
ECC_BRAINPOOLP384R1 = 26
8383
ECC_BRAINPOOLP512R1 = 27
8484

85-
RSA_PKCSV15_PAD = 0
86-
RSA_OAEP_PAD = 1
87-
RSA_PSS_PAD = 2
88-
RSA_NO_PSA = 3
89-
90-
MGF1NONE = 0
91-
MGF1SHA1 = 26
92-
MGF1SHA224 = 4
93-
MGF1SHA256 = 1
94-
MGF1SHA384 = 2
95-
MGF1SHA512 = 3
96-
97-
BLOCK_TYPE_1 = 1
98-
BLOCK_TYPE_2 = 2
99-
100-
HASH_TYPE_NONE = 0
101-
HASH_TYPE_MD2 = 1
102-
HASH_TYPE_MD4 = 2
103-
HASH_TYPE_MD5 = 3
104-
HASH_TYPE_SHA = 4
105-
HASH_TYPE_SHA224 = 5
106-
HASH_TYPE_SHA256 = 6
107-
HASH_TYPE_SHA384 = 7
108-
HASH_TYPE_SHA512 = 8
109-
HASH_TYPE_MD5_SHA = 9
110-
HASH_TYPE_SHA3_224 = 10
111-
HASH_TYPE_SHA3_256 = 11
112-
HASH_TYPE_SHA3_384 = 12
113-
HASH_TYPE_SHA3_512 = 13
114-
HASH_TYPE_BLAKE2B = 14
115-
HASH_TYPE_BLAKE2S = 15
85+
MGF1NONE = _lib.WC_MGF1NONE
86+
MGF1SHA1 = _lib.WC_MGF1SHA1
87+
MGF1SHA224 = _lib.WC_MGF1SHA224
88+
MGF1SHA256 = _lib.WC_MGF1SHA256
89+
MGF1SHA384 = _lib.WC_MGF1SHA384
90+
MGF1SHA512 = _lib.WC_MGF1SHA512
91+
92+
HASH_TYPE_NONE = _lib.WC_HASH_TYPE_NONE
93+
HASH_TYPE_MD2 = _lib.WC_HASH_TYPE_MD2
94+
HASH_TYPE_MD4 = _lib.WC_HASH_TYPE_MD4
95+
HASH_TYPE_MD5 = _lib.WC_HASH_TYPE_MD5
96+
HASH_TYPE_SHA = _lib.WC_HASH_TYPE_SHA
97+
HASH_TYPE_SHA224 = _lib.WC_HASH_TYPE_SHA224
98+
HASH_TYPE_SHA256 = _lib.WC_HASH_TYPE_SHA256
99+
HASH_TYPE_SHA384 = _lib.WC_HASH_TYPE_SHA384
100+
HASH_TYPE_SHA512 = _lib.WC_HASH_TYPE_SHA512
101+
HASH_TYPE_MD5_SHA = _lib.WC_HASH_TYPE_MD5_SHA
102+
HASH_TYPE_SHA3_224 = _lib.WC_HASH_TYPE_SHA3_224
103+
HASH_TYPE_SHA3_256 = _lib.WC_HASH_TYPE_SHA3_256
104+
HASH_TYPE_SHA3_384 = _lib.WC_HASH_TYPE_SHA3_384
105+
HASH_TYPE_SHA3_512 = _lib.WC_HASH_TYPE_SHA3_512
106+
HASH_TYPE_BLAKE2B = _lib.WC_HASH_TYPE_BLAKE2B
107+
HASH_TYPE_BLAKE2S = _lib.WC_HASH_TYPE_BLAKE2S
116108

117109

118110

@@ -515,8 +507,8 @@ def encrypt_oaep(self, plaintext, hash_type, mgf, label):
515507
ciphertext, self.output_size,
516508
self.native_object,
517509
self._random.native_object,
518-
RSA_OAEP_PAD, hash_type, mgf,
519-
label, len(label))
510+
_lib.WC_RSA_OAEP_PAD, hash_type,
511+
mgf, label, len(label))
520512

521513
if ret != self.output_size: # pragma: no cover
522514
raise WolfCryptError("Encryption error (%d)" % ret)
@@ -544,30 +536,31 @@ def verify(self, signature):
544536

545537
return _ffi.buffer(plaintext, ret)[:]
546538

547-
def verify_pss(self, plaintext, signature, hash_type, mgf):
548-
"""
549-
Verifies **signature**, using the public key data in the
550-
object. The signature's length must be equal to:
539+
if _lib.RSA_PSS_ENABLED:
540+
def verify_pss(self, plaintext, signature, hash_type, mgf):
541+
"""
542+
Verifies **signature**, using the public key data in the
543+
object. The signature's length must be equal to:
551544
552-
**self.output_size**
545+
**self.output_size**
553546
554-
Returns a string containing the plaintext.
555-
"""
556-
plaintext = t2b(plaintext)
557-
signature = t2b(signature)
558-
verify = _ffi.new("byte[%d]" % self.output_size)
547+
Returns a string containing the plaintext.
548+
"""
549+
plaintext = t2b(plaintext)
550+
signature = t2b(signature)
551+
verify = _ffi.new("byte[%d]" % self.output_size)
559552

560-
ret = _lib.wc_RsaPSS_Verify(signature, len(signature),
561-
verify, self.output_size,
562-
hash_type, mgf,
563-
self.native_object)
553+
ret = _lib.wc_RsaPSS_Verify(signature, len(signature),
554+
verify, self.output_size,
555+
hash_type, mgf,
556+
self.native_object)
564557

565-
if ret < 0: # pragma: no cover
566-
raise WolfCryptError("Verify error (%d)" % ret)
567-
ret = _lib.wc_RsaPSS_CheckPadding(plaintext, len(plaintext),
568-
verify, ret, hash_type)
558+
if ret < 0: # pragma: no cover
559+
raise WolfCryptError("Verify error (%d)" % ret)
560+
ret = _lib.wc_RsaPSS_CheckPadding(plaintext, len(plaintext),
561+
verify, ret, hash_type)
569562

570-
return ret
563+
return ret
571564

572565

573566

@@ -687,8 +680,9 @@ def decrypt_oaep(self, ciphertext, hash_type, mgf, label):
687680
plaintext = _ffi.new("byte[%d]" % self.output_size)
688681
ret = _lib.wc_RsaPrivateDecrypt_ex(ciphertext, len(ciphertext),
689682
plaintext, self.output_size,
690-
self.native_object, RSA_OAEP_PAD,
691-
hash_type, mgf, label, len(label))
683+
self.native_object,
684+
_lib.WC_RSA_OAEP_PAD, hash_type,
685+
mgf, label, len(label))
692686

693687
if ret < 0: # pragma: no cover
694688
raise WolfCryptError("Decryption error (%d)" % ret)
@@ -717,28 +711,29 @@ def sign(self, plaintext):
717711

718712
return _ffi.buffer(signature, self.output_size)[:]
719713

720-
def sign_pss(self, plaintext, hash_type, mgf):
721-
"""
722-
Signs **plaintext**, using the private key data in the object.
723-
The plaintext's length must not be greater than:
714+
if _lib.RSA_PSS_ENABLED:
715+
def sign_pss(self, plaintext, hash_type, mgf):
716+
"""
717+
Signs **plaintext**, using the private key data in the object.
718+
The plaintext's length must not be greater than:
724719
725-
**self.output_size - self.RSA_MIN_PAD_SIZE**
720+
**self.output_size - self.RSA_MIN_PAD_SIZE**
726721
727-
Returns a string containing the signature.
728-
"""
729-
plaintext = t2b(plaintext)
730-
signature = _ffi.new("byte[%d]" % self.output_size)
722+
Returns a string containing the signature.
723+
"""
724+
plaintext = t2b(plaintext)
725+
signature = _ffi.new("byte[%d]" % self.output_size)
731726

732-
ret = _lib.wc_RsaPSS_Sign(plaintext, len(plaintext),
733-
signature, self.output_size,
734-
hash_type, mgf,
735-
self.native_object,
736-
self._random.native_object)
727+
ret = _lib.wc_RsaPSS_Sign(plaintext, len(plaintext),
728+
signature, self.output_size,
729+
hash_type, mgf,
730+
self.native_object,
731+
self._random.native_object)
737732

738-
if ret != self.output_size: # pragma: no cover
739-
raise WolfCryptError("Signature error (%d)" % ret)
733+
if ret != self.output_size: # pragma: no cover
734+
raise WolfCryptError("Signature error (%d)" % ret)
740735

741-
return _ffi.buffer(signature, self.output_size)[:]
736+
return _ffi.buffer(signature, self.output_size)[:]
742737

743738

744739
if _lib.ECC_ENABLED:

0 commit comments

Comments
 (0)