Skip to content

Commit

Permalink
Check RSA-OAEP mechanims when decrypting
Browse files Browse the repository at this point in the history
The same check is in all the other methods handling the RSA-OAEP
encryption, wrapping and unwrapping, but for some reason, it was missing
in the decryption operation.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
  • Loading branch information
Jakuje committed Nov 29, 2024
1 parent a181dae commit 7a2ab9a
Showing 1 changed file with 7 additions and 16 deletions.
23 changes: 7 additions & 16 deletions src/lib/SoftHSM.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2433,6 +2433,10 @@ CK_RV SoftHSM::AsymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
if (!key->getBooleanValue(CKA_ENCRYPT, false))
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
CK_KEY_TYPE keyType = key->getUnsignedLongValue(CKA_KEY_TYPE, CKK_VENDOR_DEFINED);

Expand Down Expand Up @@ -3189,22 +3193,9 @@ CK_RV SoftHSM::AsymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
case CKM_RSA_PKCS_OAEP:
if (keyType != CKK_RSA)
return CKR_KEY_TYPE_INCONSISTENT;
if (pMechanism->pParameter == NULL_PTR ||
pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_OAEP_PARAMS))
{
DEBUG_MSG("pParameter must be of type CK_RSA_PKCS_OAEP_PARAMS");
return CKR_ARGUMENTS_BAD;
}
if (CK_RSA_PKCS_OAEP_PARAMS_PTR(pMechanism->pParameter)->hashAlg != CKM_SHA_1)
{
DEBUG_MSG("hashAlg must be CKM_SHA_1");
return CKR_ARGUMENTS_BAD;
}
if (CK_RSA_PKCS_OAEP_PARAMS_PTR(pMechanism->pParameter)->mgf != CKG_MGF1_SHA1)
{
DEBUG_MSG("mgf must be CKG_MGF1_SHA1");
return CKR_ARGUMENTS_BAD;
}
rv = MechParamCheckRSAPKCSOAEP(pMechanism);
if (rv != CKR_OK)
return rv;

mechanism = AsymMech::RSA_PKCS_OAEP;
isRSA = true;
Expand Down

0 comments on commit 7a2ab9a

Please sign in to comment.