c - Linux 内核 RSA 签名验证 crypto_akcipher_verify() 输出

Question

我目前正在开发一个内核模块，我正在其中执行 RSA 签名验证。我的模块是针对 4.4 内核的，所以我决定使用较低级别的 akcipher应用程序接口(interface)。我一直在使用当前的 implementation的 public_key_verify_signature作为指南。我的做法是:

1. 分配一个 crypto_akcipher 结构:*tfm = crypto_alloc_akcipher("rsa", 0, 0);
2. 分配一个 akcipher_request 结构:req = akcipher_request_alloc(*tfm, GFP_KERNEL);
3. 为请求设置公钥:err = crypto_akcipher_set_pub_key(*tfm, data, len);
4. 将收到的签名放入一个散点列表并将其设置为 akcipher_request 的参数:akcipher_request_set_crypt(req, &src, &dst, sig->s_size, MAX_OUT);
5. 最后调用crypto_akcipher_verify(req)应该计算预期的摘要
6. 将预期的摘要与接收到的摘要进行比较以验证签名

我目前认为我正确使用了 API，但 crypto_akcipher_verify 的输出不符合它在较新的 public_key_verify_signature 中的使用方式例子。这让我感到困惑，因为它似乎输出了正确摘要的一部分。

例如，当收到正确签名的请求时，我会得到以下结果:

Expected Digest:
e52bed356dcbf8e4b3c1458ac3e4cb49e77512e6

Computated outbuf:
01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003015300906052b0e03021a05000408e52bed356dcbf8e4

计算的 outbuf 的最后 8 个字节是预期的 20 字节摘要的前 8 个字节。但其余的outbuf似乎是垃圾。 (虽然每次都是一致的，但它始终是 0x01，然后是很多 0xffs，最后是 003015300906052b0e03021a05000408，最后 8 个字节之前)。这是负责调用 crypto_akcipher_verify(req) 的代码块:

// Init completion
init_completion(&(res.completion));

// Put the data into our request structure
memcpy(inbuf, sig->s, sig->s_size);
sg_init_one(&src, inbuf, sig->s_size);
sg_init_one(&dst, outbuf, MAX_OUT);
akcipher_request_set_crypt(req, &src, &dst, sig->s_size, MAX_OUT);

// Set the completion routine callback
// results from the verify routine will be stored in &res
akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
                  CRYPTO_TFM_REQ_MAY_SLEEP, op_complete, &res);

// Compute the expected digest
err = wait_async_op(&res, crypto_akcipher_verify(req));

if(err) {
    printk(KERN_INFO "[!] Digest computation failed %d\n", err);
    kfree(inbuf);
    kfree(outbuf);
    return err;
}

printk(KERN_INFO "\nComputation:\n");
hexdump(outbuf, req->dst_len);

/* Do the actual verification step. */
if (req->dst_len != sig->digest_size ||
    memcmp(sig->digest, outbuf, sig->digest_size) != 0) {
    printk(KERN_INFO "[!] Signature verification failed - Key Rejected: %d\n", -EKEYREJECTED);
    printk(KERN_INFO "[!] Sig len: %d   Computed len: %d\n", sig->digest_size, req->dst_len);
    kfree(inbuf);
    kfree(outbuf);
    return -EKEYREJECTED;
}

任何帮助或指向正确方向的任何帮助都将不胜感激。抱歉，如果这篇文章不是非常简洁。

Answer 1

正如@Maarten 上面所建议的。我看到的是 PKCS1 v1.5 编码。来自RFC ，填充看起来像:

EM = 0x00 || 0x01 || PS || 0x00 || T.

PS在哪里:

“PS 由 emLen - tLen - 3 个八位字节组成，十六进制值为 0xff。PS 的长度至少为 8 个八位字节。”

SHA1 末尾的 DER 编码“T”是(我将按照上面的建议切换到 SHA256):

SHA-1:   (0x)30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 || H.

在较新的内核中解析此填充的最佳方法是在调用 crypto_alloc_akcipher 时使用 "pkcs1pad(rsa,SHA256)" 类型。然后 rsa_verify 将为您解析填充。不幸的是，因为我试图将其移植到几个内核版本中，所以我不得不查看旧方法和 referenced the old rsa_verify routine .

最后我的 SHA256 EMSA PKCS#1 v1.5 解析代码如下所示:

static const u8 RSA_digest_info_SHA256[] = {
    0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
    0x05, 0x00, 0x04, 0x20
};

typedef struct RSA_ASN1_template {
    const u8 * data;
    size_t size;
} RSA_ASN1_template;

RSA_ASN1_template sha256_template;

// Derived from https://github.com/torvalds/linux/blob/db6c43bd2132dc2dd63d73a6d1ed601cffd0ae06/crypto/asymmetric_keys/rsa.c#L101
// and https://www.rfc-editor.org/rfc/rfc8017#section-9.2
// thanks to Maarten Bodewes for answering the question on Stackoverflow
// https://stackoverflow.com/questions/49662595/linux-kernel-rsa-signature-verification-crypto-akcipher-verify-output
static char *pkcs_1_v1_5_decode_emsa(unsigned char * EM,
                        unsigned long  EMlen,
                        const u8 * asn1_template,
                        size_t asn1_size,
                        size_t hash_size) {

    unsigned int t_offset, ps_end, ps_start, i;

    if (EMlen < 2 + 1 + asn1_size + hash_size)
        return NULL;    

/* Decode the EMSA-PKCS1-v1_5
 * note: leading zeros are stripped by the RSA implementation in older kernels
 * so   EM = 0x00 || 0x01 || PS || 0x00 || T
 * will become EM = 0x01 || PS || 0x00 || T.
 */
#if LINUX_VERSION_CODE < KERNEL_VERSION(4,8,0)
    ps_start = 1;
    if (EM[0] != 0x01) {
        printk(" = -EBADMSG [EM[0] == %02u]", EM[0]);
        return NULL;
    }
#else
    ps_start = 2;
    if (EM[0] != 0x00 || EM[1] != 0x01) {
        printk(" = -EBADMSG [EM[0] == %02u] [EM[1] == %02u]", EM[0], EM[1]);
        return NULL;
    }
#endif

    // Calculate offsets
    t_offset = EMlen - (asn1_size + hash_size);
    ps_end = t_offset - 1;

    // Check if there's a 0x00 seperator between PS and T
    if (EM[ps_end] != 0x00) {
        printk(" = -EBADMSG [EM[T-1] == %02u]", EM[ps_end]);
        return NULL;
    }

    // Check the PS 0xff padding 
    for (i = ps_start; i < ps_end; i++) {
        if (EM[i] != 0xff) {
            printk(" = -EBADMSG [EM[PS%x] == %02u]", i - 2, EM[i]);
            return NULL;
        }
    }

    // Compare the DER encoding T of the DigestInfo value
    if (crypto_memneq(asn1_template, EM + t_offset, asn1_size) != 0) {
        printk(" = -EBADMSG [EM[T] ASN.1 mismatch]");
        return NULL;
    }

    return EM + t_offset + asn1_size;

}

以及调用它的验证函数:

// Verify a recieved signature
int verify_sig_rsa(akcipher_request * req, pkey_signature * sig) {

    int err;
    void *inbuf, *outbuf, *result = NULL;
    op_result res;
    struct scatterlist src, dst;
    crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
    int MAX_OUT = crypto_akcipher_maxsize(tfm);


    inbuf = kzalloc(PAGE_SIZE, GFP_KERNEL);

    err = -ENOMEM;
    if(!inbuf) {
        return err;
    }

    outbuf = kzalloc(MAX_OUT, GFP_KERNEL);

    if(!outbuf) {
        kfree(inbuf);
        return err;
    } 

    // Init completion
    init_completion(&(res.completion));

    // Put the data into our request structure
    memcpy(inbuf, sig->s, sig->s_size);
    sg_init_one(&src, inbuf, sig->s_size);
    sg_init_one(&dst, outbuf, MAX_OUT);
    akcipher_request_set_crypt(req, &src, &dst, sig->s_size, MAX_OUT);

    // Set the completion routine callback
    // results from the verify routine will be stored in &res
    akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
                  CRYPTO_TFM_REQ_MAY_SLEEP, op_complete, &res);

    // Compute the expected digest
    err = wait_async_op(&res, crypto_akcipher_verify(req));

    if(err) {
        printk(KERN_INFO "[!] Digest computation failed %d\n", err);
        kfree(inbuf);
        kfree(outbuf);
        kfree(result);
        return err;
    }

    // Decode the PKCS#1 v1.5 encoding
    sha256_template.data = RSA_digest_info_SHA256;
    sha256_template.size = ARRAY_SIZE(RSA_digest_info_SHA256);
    result = pkcs_1_v1_5_decode_emsa(outbuf, req->dst_len, 
             sha256_template.data, sha256_template.size, 32);

    err = -EINVAL;
    if(!result) {
        printk(KERN_INFO "[!] EMSA PKCS#1 v1.5 decode failed\n");
        kfree(inbuf);
        kfree(outbuf);
        return err;
    }

    printk(KERN_INFO "\nComputation:\n");
    hexdump(result, 20); 

    /* Do the actual verification step. */
    if (crypto_memneq(sig->digest, result, sig->digest_size) != 0) {
        printk(KERN_INFO "[!] Signature verification failed - Key Rejected: %d\n", -EKEYREJECTED);
        kfree(inbuf);
        kfree(outbuf);
        return -EKEYREJECTED;
    }
    
    printk(KERN_INFO "[+] RSA signature verification passed\n");
    kfree(inbuf);
    kfree(outbuf);
    return 0;
}

如果有人想引用完整的代码，它can be found here .