123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276 |
- var forge = require('./forge');
- require('./util');
- require('./random');
- require('./sha1');
- var pkcs1 = module.exports = forge.pkcs1 = forge.pkcs1 || {};
- pkcs1.encode_rsa_oaep = function(key, message, options) {
-
- var label;
- var seed;
- var md;
- var mgf1Md;
-
- if(typeof options === 'string') {
- label = options;
- seed = arguments[3] || undefined;
- md = arguments[4] || undefined;
- } else if(options) {
- label = options.label || undefined;
- seed = options.seed || undefined;
- md = options.md || undefined;
- if(options.mgf1 && options.mgf1.md) {
- mgf1Md = options.mgf1.md;
- }
- }
-
- if(!md) {
- md = forge.md.sha1.create();
- } else {
- md.start();
- }
-
- if(!mgf1Md) {
- mgf1Md = md;
- }
-
- var keyLength = Math.ceil(key.n.bitLength() / 8);
- var maxLength = keyLength - 2 * md.digestLength - 2;
- if(message.length > maxLength) {
- var error = new Error('RSAES-OAEP input message length is too long.');
- error.length = message.length;
- error.maxLength = maxLength;
- throw error;
- }
- if(!label) {
- label = '';
- }
- md.update(label, 'raw');
- var lHash = md.digest();
- var PS = '';
- var PS_length = maxLength - message.length;
- for(var i = 0; i < PS_length; i++) {
- PS += '\x00';
- }
- var DB = lHash.getBytes() + PS + '\x01' + message;
- if(!seed) {
- seed = forge.random.getBytes(md.digestLength);
- } else if(seed.length !== md.digestLength) {
- var error = new Error('Invalid RSAES-OAEP seed. The seed length must ' +
- 'match the digest length.');
- error.seedLength = seed.length;
- error.digestLength = md.digestLength;
- throw error;
- }
- var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, mgf1Md);
- var maskedDB = forge.util.xorBytes(DB, dbMask, DB.length);
- var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
- var maskedSeed = forge.util.xorBytes(seed, seedMask, seed.length);
-
- return '\x00' + maskedSeed + maskedDB;
- };
- pkcs1.decode_rsa_oaep = function(key, em, options) {
-
- var label;
- var md;
- var mgf1Md;
-
- if(typeof options === 'string') {
- label = options;
- md = arguments[3] || undefined;
- } else if(options) {
- label = options.label || undefined;
- md = options.md || undefined;
- if(options.mgf1 && options.mgf1.md) {
- mgf1Md = options.mgf1.md;
- }
- }
-
- var keyLength = Math.ceil(key.n.bitLength() / 8);
- if(em.length !== keyLength) {
- var error = new Error('RSAES-OAEP encoded message length is invalid.');
- error.length = em.length;
- error.expectedLength = keyLength;
- throw error;
- }
-
- if(md === undefined) {
- md = forge.md.sha1.create();
- } else {
- md.start();
- }
-
- if(!mgf1Md) {
- mgf1Md = md;
- }
- if(keyLength < 2 * md.digestLength + 2) {
- throw new Error('RSAES-OAEP key is too short for the hash function.');
- }
- if(!label) {
- label = '';
- }
- md.update(label, 'raw');
- var lHash = md.digest().getBytes();
-
- var y = em.charAt(0);
- var maskedSeed = em.substring(1, md.digestLength + 1);
- var maskedDB = em.substring(1 + md.digestLength);
- var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
- var seed = forge.util.xorBytes(maskedSeed, seedMask, maskedSeed.length);
- var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, mgf1Md);
- var db = forge.util.xorBytes(maskedDB, dbMask, maskedDB.length);
- var lHashPrime = db.substring(0, md.digestLength);
-
- var error = (y !== '\x00');
-
- for(var i = 0; i < md.digestLength; ++i) {
- error |= (lHash.charAt(i) !== lHashPrime.charAt(i));
- }
-
-
-
- var in_ps = 1;
- var index = md.digestLength;
- for(var j = md.digestLength; j < db.length; j++) {
- var code = db.charCodeAt(j);
- var is_0 = (code & 0x1) ^ 0x1;
-
- var error_mask = in_ps ? 0xfffe : 0x0000;
- error |= (code & error_mask);
-
- in_ps = in_ps & is_0;
- index += in_ps;
- }
- if(error || db.charCodeAt(index) !== 0x1) {
- throw new Error('Invalid RSAES-OAEP padding.');
- }
- return db.substring(index + 1);
- };
- function rsa_mgf1(seed, maskLength, hash) {
-
- if(!hash) {
- hash = forge.md.sha1.create();
- }
- var t = '';
- var count = Math.ceil(maskLength / hash.digestLength);
- for(var i = 0; i < count; ++i) {
- var c = String.fromCharCode(
- (i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF);
- hash.start();
- hash.update(seed + c);
- t += hash.digest().getBytes();
- }
- return t.substring(0, maskLength);
- }
|