lib/gnutls_sig.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 #include <gnutls_int.h>
  24 #include <gnutls_errors.h>
  25 #include <x509_b64.h>
  26 #include <auth/cert.h>
  27 #include <algorithms.h>
  28 #include <gnutls_datum.h>
  29 #include <gnutls_mpi.h>
  30 #include <gnutls_global.h>
  31 #include <gnutls_pk.h>
  32 #include <debug.h>
  33 #include <gnutls_buffers.h>
  34 #include <gnutls_sig.h>
  35 #include <gnutls_kx.h>
  36 #include <libtasn1.h>
  37 #include <ext/signature.h>
  38 #include <gnutls_state.h>
  39 #include <x509/common.h>
  40 #include <abstract_int.h>
  41
  42 static int
  43 sign_tls_hash (gnutls_session_t session, gnutls_digest_algorithm_t hash_algo,
  44                   gnutls_pcert_st* cert, gnutls_privkey_t pkey,
  45                   const gnutls_datum_t * hash_concat,
  46                   gnutls_datum_t * signature);
  47
  48 static int
  49 encode_ber_digest_info (gnutls_digest_algorithm_t hash,
  50                         const gnutls_datum_t * digest,
  51                         gnutls_datum_t * output);
  52
  53 /* While this is currently equal to the length of RSA/SHA512
  54  * signature, it should also be sufficient for DSS signature and any
  55  * other RSA signatures including one with the old MD5/SHA1-combined
  56  * format.
  57  */
  58 #define MAX_SIG_SIZE 19 + MAX_HASH_SIZE
  59
  60 /* Generates a signature of all the random data and the parameters.
  61  * Used in DHE_* ciphersuites.
  62  */
  63 int
  64 _gnutls_handshake_sign_data (gnutls_session_t session, gnutls_pcert_st* cert,
  65                              gnutls_privkey_t pkey, gnutls_datum_t * params,
  66                              gnutls_datum_t * signature,
  67                              gnutls_sign_algorithm_t * sign_algo)
  68 {
  69   gnutls_datum_t dconcat;
  70   int ret;
  71   digest_hd_st td_sha;
  72   uint8_t concat[MAX_SIG_SIZE];
  73   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
  74   gnutls_digest_algorithm_t hash_algo;
  75
  76   *sign_algo =
  77     _gnutls_session_get_sign_algo (session, cert);
  78   if (*sign_algo == GNUTLS_SIGN_UNKNOWN)
  79     {
  80       gnutls_assert ();
  81       return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
  82     }
  83
  84   hash_algo = _gnutls_sign_get_hash_algorithm (*sign_algo);
  85
  86   _gnutls_handshake_log ("HSK[%p]: signing handshake data: using %s\n",
  87                     session, gnutls_sign_algorithm_get_name (*sign_algo));
  88
  89   ret = _gnutls_hash_init (&td_sha, hash_algo);
  90   if (ret < 0)
  91     {
  92       gnutls_assert ();
  93       return ret;
  94     }
  95
  96   _gnutls_hash (&td_sha, session->security_parameters.client_random,
  97                 GNUTLS_RANDOM_SIZE);
  98   _gnutls_hash (&td_sha, session->security_parameters.server_random,
  99                 GNUTLS_RANDOM_SIZE);
 100   _gnutls_hash (&td_sha, params->data, params->size);
 101
 102   switch (gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL))
 103     {
 104     case GNUTLS_PK_RSA:
 105       if (!_gnutls_version_has_selectable_sighash (ver))
 106         {
 107           digest_hd_st td_md5;
 108
 109           ret = _gnutls_hash_init (&td_md5, GNUTLS_MAC_MD5);
 110           if (ret < 0)
 111             {
 112               gnutls_assert ();
 113               return ret;
 114             }
 115
 116           _gnutls_hash (&td_md5, session->security_parameters.client_random,
 117                         GNUTLS_RANDOM_SIZE);
 118           _gnutls_hash (&td_md5, session->security_parameters.server_random,
 119                         GNUTLS_RANDOM_SIZE);
 120           _gnutls_hash (&td_md5, params->data, params->size);
 121
 122           _gnutls_hash_deinit (&td_md5, concat);
 123           _gnutls_hash_deinit (&td_sha, &concat[16]);
 124
 125           dconcat.data = concat;
 126           dconcat.size = 36;
 127         }
 128       else
 129         { /* TLS 1.2 way */
 130
 131           _gnutls_hash_deinit (&td_sha, concat);
 132
 133           dconcat.data = concat;
 134           dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 135         }
 136       break;
 137     case GNUTLS_PK_DSA:
 138     case GNUTLS_PK_EC:
 139       _gnutls_hash_deinit (&td_sha, concat);
 140
 141       if (!IS_SHA(hash_algo))
 142         {
 143           gnutls_assert ();
 144           return GNUTLS_E_INTERNAL_ERROR;
 145         }
 146       dconcat.data = concat;
 147       dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 148       break;
 149
 150     default:
 151       gnutls_assert ();
 152       _gnutls_hash_deinit (&td_sha, NULL);
 153       return GNUTLS_E_INTERNAL_ERROR;
 154     }
 155
 156   ret = sign_tls_hash (session, hash_algo, cert, pkey, &dconcat, signature);
 157   if (ret < 0)
 158     {
 159       gnutls_assert ();
 160     }
 161
 162   return ret;
 163
 164 }
 165
 166
 167 /* This will create a PKCS1 or DSA signature, using the given parameters, and the
 168  * given data. The output will be allocated and be put in signature.
 169  */
 170 int
 171 _gnutls_soft_sign (gnutls_pk_algorithm_t algo, gnutls_pk_params_st * params,
 172                    const gnutls_datum_t * data,
 173                    gnutls_datum_t * signature)
 174 {
 175   int ret;
 176
 177   switch (algo)
 178     {
 179     case GNUTLS_PK_RSA:
 180       /* encrypt */
 181       if ((ret = _gnutls_pkcs1_rsa_encrypt (signature, data, params, 1)) < 0)
 182         {
 183           gnutls_assert ();
 184           return ret;
 185         }
 186
 187       break;
 188     default:
 189       ret = _gnutls_pk_sign( algo, signature, data, params);
 190       if (ret < 0)
 191         {
 192           gnutls_assert ();
 193           return ret;
 194         }
 195       break;
 196     }
 197
 198   return 0;
 199 }
 200
 201 /* This will create a PKCS1 or DSA signature, as defined in the TLS protocol.
 202  * Cert is the certificate of the corresponding private key. It is only checked if
 203  * it supports signing.
 204  */
 205 static int
 206 sign_tls_hash (gnutls_session_t session, gnutls_digest_algorithm_t hash_algo,
 207                   gnutls_pcert_st* cert, gnutls_privkey_t pkey,
 208                   const gnutls_datum_t * hash_concat,
 209                   gnutls_datum_t * signature)
 210 {
 211   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 212   unsigned int key_usage = 0;
 213   /* If our certificate supports signing
 214    */
 215
 216   if (cert != NULL)
 217     {
 218       gnutls_pubkey_get_key_usage(cert->pubkey, &key_usage);
 219
 220       if (key_usage != 0)
 221         if (!(key_usage & GNUTLS_KEY_DIGITAL_SIGNATURE))
 222           {
 223             gnutls_assert ();
 224             if (session->internals.priorities.allow_key_usage_violation == 0)
 225               return GNUTLS_E_KEY_USAGE_VIOLATION;
 226             else
 227               _gnutls_audit_log(session, "Key usage violation was detected (ignored).\n");
 228           }
 229
 230       /* External signing. Deprecated. To be removed. */
 231       if (!pkey)
 232         {
 233           int ret;
 234
 235           if (!session->internals.sign_func)
 236             return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_CREDENTIALS);
 237
 238           if (!_gnutls_version_has_selectable_sighash (ver))
 239             return (*session->internals.sign_func)
 240               (session, session->internals.sign_func_userdata,
 241                cert->type, &cert->cert, hash_concat, signature);
 242           else
 243             {
 244               gnutls_datum_t digest;
 245
 246               ret = _gnutls_set_datum(&digest, hash_concat->data, hash_concat->size);
 247               if (ret < 0)
 248                 return gnutls_assert_val(ret);
 249
 250               ret = pk_prepare_hash (gnutls_privkey_get_pk_algorithm(pkey, NULL), hash_algo, &digest);
 251               if (ret < 0)
 252                 {
 253                   gnutls_assert ();
 254                   goto es_cleanup;
 255                 }
 256
 257               ret = (*session->internals.sign_func)
 258                 (session, session->internals.sign_func_userdata,
 259                  cert->type, &cert->cert, &digest, signature);
 260 es_cleanup:
 261               gnutls_free(digest.data);
 262
 263               return ret;
 264             }
 265         }
 266     }
 267
 268    if (!_gnutls_version_has_selectable_sighash (ver))
 269     return _gnutls_privkey_sign_hash (pkey, hash_concat, signature);
 270   else
 271     return gnutls_privkey_sign_hash (pkey, hash_algo, 0, hash_concat, signature);
 272 }
 273
 274 static int
 275 verify_tls_hash (gnutls_session_t session, gnutls_protocol_t ver, gnutls_pcert_st* cert,
 276                     const gnutls_datum_t * hash_concat,
 277                     gnutls_datum_t * signature, size_t sha1pos,
 278                     gnutls_sign_algorithm_t sign_algo,
 279                     gnutls_pk_algorithm_t pk_algo)
 280 {
 281   int ret;
 282   gnutls_datum_t vdata;
 283   unsigned int key_usage = 0, flags;
 284
 285   if (cert == NULL)
 286     {
 287       gnutls_assert ();
 288       return GNUTLS_E_CERTIFICATE_ERROR;
 289     }
 290
 291   gnutls_pubkey_get_key_usage(cert->pubkey, &key_usage);
 292
 293   /* If the certificate supports signing continue.
 294    */
 295   if (key_usage != 0)
 296     if (!(key_usage & GNUTLS_KEY_DIGITAL_SIGNATURE))
 297       {
 298         gnutls_assert ();
 299         if (session->internals.priorities.allow_key_usage_violation == 0)
 300           return GNUTLS_E_KEY_USAGE_VIOLATION;
 301         else
 302           _gnutls_audit_log(session, "Key usage violation was detected (ignored).\n");
 303       }
 304
 305   if (pk_algo == GNUTLS_PK_UNKNOWN)
 306     pk_algo = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);
 307   switch (pk_algo)
 308     {
 309     case GNUTLS_PK_RSA:
 310
 311       vdata.data = hash_concat->data;
 312       vdata.size = hash_concat->size;
 313
 314       /* verify signature */
 315       if (!_gnutls_version_has_selectable_sighash (ver))
 316         flags = GNUTLS_PUBKEY_VERIFY_FLAG_TLS_RSA;
 317       else
 318         flags = 0;
 319
 320
 321       break;
 322     case GNUTLS_PK_DSA:
 323     case GNUTLS_PK_EC:
 324
 325       vdata.data = &hash_concat->data[sha1pos];
 326       vdata.size = hash_concat->size - sha1pos;
 327
 328       flags = 0;
 329
 330       break;
 331     default:
 332       gnutls_assert ();
 333       return GNUTLS_E_INTERNAL_ERROR;
 334     }
 335
 336   ret = gnutls_pubkey_verify_hash2(cert->pubkey, sign_algo, flags,
 337                                    &vdata, signature);
 338
 339   if (ret < 0)
 340     return gnutls_assert_val(ret);
 341
 342
 343   return 0;
 344 }
 345
 346
 347 /* Generates a signature of all the random data and the parameters.
 348  * Used in DHE_* ciphersuites.
 349  */
 350 int
 351 _gnutls_handshake_verify_data (gnutls_session_t session, gnutls_pcert_st* cert,
 352                                const gnutls_datum_t * params,
 353                                gnutls_datum_t * signature,
 354                                gnutls_sign_algorithm_t sign_algo)
 355 {
 356   gnutls_datum_t dconcat;
 357   int ret;
 358   digest_hd_st td_md5;
 359   digest_hd_st td_sha;
 360   uint8_t concat[MAX_SIG_SIZE];
 361   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 362   gnutls_digest_algorithm_t hash_algo;
 363
 364   if (_gnutls_version_has_selectable_sighash (ver))
 365     {
 366       _gnutls_handshake_log ("HSK[%p]: verify handshake data: using %s\n",
 367                     session, gnutls_sign_algorithm_get_name (sign_algo));
 368
 369       ret = _gnutls_pubkey_compatible_with_sig(session, cert->pubkey, ver, sign_algo);
 370       if (ret < 0)
 371         return gnutls_assert_val(ret);
 372
 373       ret = _gnutls_session_sign_algo_enabled (session, sign_algo);
 374       if (ret < 0)
 375         return gnutls_assert_val(ret);
 376
 377       hash_algo = _gnutls_sign_get_hash_algorithm (sign_algo);
 378     }
 379   else
 380     {
 381       ret = _gnutls_hash_init (&td_md5, GNUTLS_MAC_MD5);
 382       if (ret < 0)
 383         {
 384           gnutls_assert ();
 385           return ret;
 386         }
 387
 388       _gnutls_hash (&td_md5, session->security_parameters.client_random,
 389                     GNUTLS_RANDOM_SIZE);
 390       _gnutls_hash (&td_md5, session->security_parameters.server_random,
 391                     GNUTLS_RANDOM_SIZE);
 392       _gnutls_hash (&td_md5, params->data, params->size);
 393
 394       hash_algo = GNUTLS_DIG_SHA1;
 395     }
 396
 397   ret = _gnutls_hash_init (&td_sha, hash_algo);
 398   if (ret < 0)
 399     {
 400       gnutls_assert ();
 401       if (!_gnutls_version_has_selectable_sighash (ver))
 402         _gnutls_hash_deinit (&td_md5, NULL);
 403       return ret;
 404     }
 405
 406   _gnutls_hash (&td_sha, session->security_parameters.client_random,
 407                 GNUTLS_RANDOM_SIZE);
 408   _gnutls_hash (&td_sha, session->security_parameters.server_random,
 409                 GNUTLS_RANDOM_SIZE);
 410   _gnutls_hash (&td_sha, params->data, params->size);
 411
 412   if (!_gnutls_version_has_selectable_sighash (ver))
 413     {
 414       _gnutls_hash_deinit (&td_md5, concat);
 415       _gnutls_hash_deinit (&td_sha, &concat[16]);
 416       dconcat.data = concat;
 417       dconcat.size = 36;
 418     }
 419   else
 420     {
 421       _gnutls_hash_deinit (&td_sha, concat);
 422
 423       dconcat.data = concat;
 424       dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 425     }
 426
 427   ret = verify_tls_hash (session, ver, cert, &dconcat, signature,
 428                             dconcat.size -
 429                             _gnutls_hash_get_algo_len (hash_algo),
 430                             sign_algo,
 431                             _gnutls_sign_get_pk_algorithm (sign_algo));
 432   if (ret < 0)
 433     {
 434       gnutls_assert ();
 435       return ret;
 436     }
 437
 438   return ret;
 439
 440 }
 441
 442 /* Client certificate verify calculations
 443  */
 444
 445 /* this is _gnutls_handshake_verify_crt_vrfy for TLS 1.2
 446  */
 447 static int
 448 _gnutls_handshake_verify_crt_vrfy12 (gnutls_session_t session,
 449                                       gnutls_pcert_st*  cert,
 450                                       gnutls_datum_t * signature,
 451                                       gnutls_sign_algorithm_t sign_algo)
 452 {
 453   int ret;
 454   uint8_t concat[MAX_HASH_SIZE];
 455   gnutls_datum_t dconcat;
 456   gnutls_digest_algorithm_t hash_algo;
 457   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 458   gnutls_pk_algorithm_t pk = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);
 459
 460   ret = _gnutls_session_sign_algo_enabled(session, sign_algo);
 461   if (ret < 0)
 462     return gnutls_assert_val(ret);
 463
 464   hash_algo = _gnutls_sign_get_hash_algorithm(sign_algo);
 465
 466   ret = _gnutls_hash_fast(hash_algo, session->internals.handshake_hash_buffer.data,
 467                           session->internals.handshake_hash_buffer_prev_len,
 468                           concat);
 469   if (ret < 0)
 470     return gnutls_assert_val(ret);
 471
 472   dconcat.data = concat;
 473   dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 474
 475   ret =
 476     verify_tls_hash (session, ver, cert, &dconcat, signature, 0, sign_algo, pk);
 477   if (ret < 0)
 478     {
 479       gnutls_assert ();
 480       return ret;
 481     }
 482
 483   return ret;
 484
 485 }
 486
 487 /* Verifies a TLS signature (like the one in the client certificate
 488  * verify message).
 489  */
 490 int
 491 _gnutls_handshake_verify_crt_vrfy (gnutls_session_t session,
 492                                     gnutls_pcert_st *cert,
 493                                     gnutls_datum_t * signature,
 494                                     gnutls_sign_algorithm_t sign_algo)
 495 {
 496   int ret;
 497   uint8_t concat[MAX_SIG_SIZE];
 498   digest_hd_st td_md5;
 499   digest_hd_st td_sha;
 500   gnutls_datum_t dconcat;
 501   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 502
 503   _gnutls_handshake_log ("HSK[%p]: verify cert vrfy: using %s\n",
 504                     session, gnutls_sign_algorithm_get_name (sign_algo));
 505
 506
 507   if (_gnutls_version_has_selectable_sighash(ver))
 508     return _gnutls_handshake_verify_crt_vrfy12 (session, cert, signature,
 509                                                  sign_algo);
 510
 511   ret =
 512     _gnutls_hash_init (&td_md5, GNUTLS_DIG_MD5);
 513   if (ret < 0)
 514     {
 515       gnutls_assert ();
 516       return ret;
 517     }
 518
 519   ret =
 520     _gnutls_hash_init (&td_sha, GNUTLS_DIG_SHA1);
 521   if (ret < 0)
 522     {
 523       gnutls_assert ();
 524       _gnutls_hash_deinit (&td_md5, NULL);
 525       return GNUTLS_E_HASH_FAILED;
 526     }
 527
 528   _gnutls_hash(&td_sha, session->internals.handshake_hash_buffer.data, session->internals.handshake_hash_buffer_prev_len);
 529   _gnutls_hash(&td_md5, session->internals.handshake_hash_buffer.data, session->internals.handshake_hash_buffer_prev_len);
 530
 531   if (ver == GNUTLS_SSL3)
 532     {
 533       ret = _gnutls_generate_master (session, 1);
 534       if (ret < 0)
 535         {
 536           _gnutls_hash_deinit (&td_md5, NULL);
 537           _gnutls_hash_deinit (&td_sha, NULL);
 538           return gnutls_assert_val(ret);
 539         }
 540
 541       ret = _gnutls_mac_deinit_ssl3_handshake (&td_md5, concat,
 542                                          session->
 543                                          security_parameters.master_secret,
 544                                          GNUTLS_MASTER_SIZE);
 545       if (ret < 0)
 546         {
 547           _gnutls_hash_deinit (&td_sha, NULL);
 548           return gnutls_assert_val(ret);
 549         }
 550
 551       ret = _gnutls_mac_deinit_ssl3_handshake (&td_sha, &concat[16],
 552                                          session->
 553                                          security_parameters.master_secret,
 554                                          GNUTLS_MASTER_SIZE);
 555       if (ret < 0)
 556         {
 557           return gnutls_assert_val(ret);
 558         }
 559     }
 560   else
 561     {
 562       _gnutls_hash_deinit (&td_md5, concat);
 563       _gnutls_hash_deinit (&td_sha, &concat[16]);
 564     }
 565
 566   dconcat.data = concat;
 567   dconcat.size = 20 + 16;       /* md5+ sha */
 568
 569   ret =
 570     verify_tls_hash (session, ver, cert, &dconcat, signature, 16,
 571                         GNUTLS_SIGN_UNKNOWN,
 572                         gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL));
 573   if (ret < 0)
 574     {
 575       gnutls_assert ();
 576       return ret;
 577     }
 578
 579   return ret;
 580
 581 }
 582
 583 /* the same as _gnutls_handshake_sign_crt_vrfy except that it is made for TLS 1.2
 584  */
 585 static int
 586 _gnutls_handshake_sign_crt_vrfy12 (gnutls_session_t session,
 587                                     gnutls_pcert_st* cert, gnutls_privkey_t pkey,
 588                                     gnutls_datum_t * signature)
 589 {
 590   gnutls_datum_t dconcat;
 591   int ret;
 592   uint8_t concat[MAX_SIG_SIZE];
 593   gnutls_sign_algorithm_t sign_algo;
 594   gnutls_digest_algorithm_t hash_algo;
 595
 596   sign_algo =
 597     _gnutls_session_get_sign_algo (session, cert);
 598   if (sign_algo == GNUTLS_SIGN_UNKNOWN)
 599     {
 600       gnutls_assert ();
 601       return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
 602     }
 603
 604   hash_algo = _gnutls_sign_get_hash_algorithm (sign_algo);
 605
 606   _gnutls_debug_log ("sign handshake cert vrfy: picked %s with %s\n",
 607                     gnutls_sign_algorithm_get_name (sign_algo),
 608                     gnutls_mac_get_name ((gnutls_mac_algorithm_t)hash_algo));
 609
 610   ret = _gnutls_hash_fast (hash_algo, session->internals.handshake_hash_buffer.data,
 611                            session->internals.handshake_hash_buffer.length,
 612                            concat);
 613   if (ret < 0)
 614     return gnutls_assert_val(ret);
 615
 616   dconcat.data = concat;
 617   dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 618
 619   ret = sign_tls_hash (session, hash_algo, cert, pkey, &dconcat, signature);
 620   if (ret < 0)
 621     {
 622       gnutls_assert ();
 623       return ret;
 624     }
 625
 626   return sign_algo;
 627 }
 628
 629
 630 /* Generates a signature of all the previous sent packets in the
 631  * handshake procedure.
 632  * 20040227: now it works for SSL 3.0 as well
 633  * 20091031: works for TLS 1.2 too!
 634  *
 635  * For TLS1.x, x<2 returns negative for failure and zero or unspecified for success.
 636  * For TLS1.2 returns the signature algorithm used on success, or a negative error code;
 637  */
 638 int
 639 _gnutls_handshake_sign_crt_vrfy (gnutls_session_t session,
 640                                   gnutls_pcert_st* cert, gnutls_privkey_t pkey,
 641                                   gnutls_datum_t * signature)
 642 {
 643   gnutls_datum_t dconcat;
 644   int ret;
 645   uint8_t concat[MAX_SIG_SIZE];
 646   digest_hd_st td_md5;
 647   digest_hd_st td_sha;
 648   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 649   gnutls_pk_algorithm_t pk = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);
 650
 651   if (_gnutls_version_has_selectable_sighash(ver))
 652     return _gnutls_handshake_sign_crt_vrfy12 (session, cert, pkey,
 653                                                  signature);
 654
 655   ret =
 656     _gnutls_hash_init (&td_sha, GNUTLS_DIG_SHA1);
 657   if (ret < 0)
 658     {
 659       gnutls_assert ();
 660       return ret;
 661     }
 662
 663   _gnutls_hash(&td_sha, session->internals.handshake_hash_buffer.data, session->internals.handshake_hash_buffer.length);
 664
 665   if (ver == GNUTLS_SSL3)
 666     {
 667       ret = _gnutls_generate_master (session, 1);
 668       if (ret < 0)
 669         {
 670           gnutls_assert ();
 671           _gnutls_hash_deinit (&td_sha, NULL);
 672           return ret;
 673         }
 674
 675       ret = _gnutls_mac_deinit_ssl3_handshake (&td_sha, &concat[16],
 676                                          session->
 677                                          security_parameters.master_secret,
 678                                          GNUTLS_MASTER_SIZE);
 679       if (ret < 0)
 680         return gnutls_assert_val(ret);
 681     }
 682   else
 683     _gnutls_hash_deinit (&td_sha, &concat[16]);
 684
 685   /* ensure 1024 bit DSA keys are used */
 686   ret = _gnutls_pubkey_compatible_with_sig(session, cert->pubkey, ver, GNUTLS_SIGN_UNKNOWN);
 687   if (ret < 0)
 688     return gnutls_assert_val(ret);
 689
 690   switch (pk)
 691     {
 692     case GNUTLS_PK_RSA:
 693       ret =
 694         _gnutls_hash_init (&td_md5, GNUTLS_DIG_MD5);
 695       if (ret < 0)
 696         return gnutls_assert_val(ret);
 697
 698       _gnutls_hash(&td_md5, session->internals.handshake_hash_buffer.data, session->internals.handshake_hash_buffer.length);
 699
 700       if (ver == GNUTLS_SSL3)
 701         {
 702           ret = _gnutls_mac_deinit_ssl3_handshake (&td_md5, concat,
 703                                            session->
 704                                            security_parameters.master_secret,
 705                                            GNUTLS_MASTER_SIZE);
 706           if (ret < 0)
 707             return gnutls_assert_val(ret);
 708         }
 709       else
 710         _gnutls_hash_deinit (&td_md5, concat);
 711
 712       dconcat.data = concat;
 713       dconcat.size = 36;
 714       break;
 715     case GNUTLS_PK_DSA:
 716     case GNUTLS_PK_EC:
 717
 718       dconcat.data = &concat[16];
 719       dconcat.size = 20;
 720       break;
 721
 722     default:
 723       return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 724     }
 725   ret = sign_tls_hash (session, GNUTLS_DIG_NULL, cert, pkey, &dconcat, signature);
 726   if (ret < 0)
 727     {
 728       gnutls_assert ();
 729     }
 730
 731   return ret;
 732 }
 733
 734 int
 735 pk_hash_data (gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash,
 736               gnutls_pk_params_st* params,
 737               const gnutls_datum_t * data, gnutls_datum_t * digest)
 738 {
 739   int ret;
 740
 741   digest->size = _gnutls_hash_get_algo_len (hash);
 742   digest->data = gnutls_malloc (digest->size);
 743   if (digest->data == NULL)
 744     {
 745       gnutls_assert ();
 746       return GNUTLS_E_MEMORY_ERROR;
 747     }
 748
 749   ret = _gnutls_hash_fast (hash, data->data, data->size, digest->data);
 750   if (ret < 0)
 751     {
 752       gnutls_assert ();
 753       goto cleanup;
 754     }
 755
 756   return 0;
 757
 758 cleanup:
 759   gnutls_free (digest->data);
 760   return ret;
 761 }
 762
 763
 764 /*
 765  * This function will do RSA PKCS #1 1.5 encoding
 766  * on the given digest. The given digest must be allocated
 767  * and will be freed if replacement is required.
 768  */
 769 int
 770 pk_prepare_hash (gnutls_pk_algorithm_t pk,
 771                  gnutls_digest_algorithm_t hash, gnutls_datum_t * digest)
 772 {
 773   int ret;
 774   gnutls_datum_t old_digest = { digest->data, digest->size };
 775
 776   switch (pk)
 777     {
 778     case GNUTLS_PK_RSA:
 779       /* Encode the digest as a DigestInfo
 780        */
 781       if ((ret = encode_ber_digest_info (hash, &old_digest, digest)) != 0)
 782         {
 783           gnutls_assert ();
 784           return ret;
 785         }
 786
 787       _gnutls_free_datum (&old_digest);
 788       break;
 789     case GNUTLS_PK_DSA:
 790     case GNUTLS_PK_EC:
 791       break;
 792     default:
 793       gnutls_assert ();
 794       return GNUTLS_E_UNIMPLEMENTED_FEATURE;
 795     }
 796
 797   return 0;
 798 }
 799
 800 /* Reads the digest information.
 801  * we use DER here, although we should use BER. It works fine
 802  * anyway.
 803  */
 804 int
 805 decode_ber_digest_info (const gnutls_datum_t * info,
 806                         gnutls_digest_algorithm_t * hash,
 807                         uint8_t * digest, unsigned int *digest_size)
 808 {
 809   ASN1_TYPE dinfo = ASN1_TYPE_EMPTY;
 810   int result;
 811   char str[1024];
 812   int len;
 813
 814   if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
 815                                      "GNUTLS.DigestInfo",
 816                                      &dinfo)) != ASN1_SUCCESS)
 817     {
 818       gnutls_assert ();
 819       return _gnutls_asn2err (result);
 820     }
 821
 822   result = asn1_der_decoding (&dinfo, info->data, info->size, NULL);
 823   if (result != ASN1_SUCCESS)
 824     {
 825       gnutls_assert ();
 826       asn1_delete_structure (&dinfo);
 827       return _gnutls_asn2err (result);
 828     }
 829
 830   len = sizeof (str) - 1;
 831   result = asn1_read_value (dinfo, "digestAlgorithm.algorithm", str, &len);
 832   if (result != ASN1_SUCCESS)
 833     {
 834       gnutls_assert ();
 835       asn1_delete_structure (&dinfo);
 836       return _gnutls_asn2err (result);
 837     }
 838
 839   *hash = _gnutls_x509_oid_to_digest (str);
 840
 841   if (*hash == GNUTLS_DIG_UNKNOWN)
 842     {
 843
 844       _gnutls_debug_log ("verify.c: HASH OID: %s\n", str);
 845
 846       gnutls_assert ();
 847       asn1_delete_structure (&dinfo);
 848       return GNUTLS_E_UNKNOWN_ALGORITHM;
 849     }
 850
 851   len = sizeof (str) - 1;
 852   result = asn1_read_value (dinfo, "digestAlgorithm.parameters", str, &len);
 853   /* To avoid permitting garbage in the parameters field, either the
 854      parameters field is not present, or it contains 0x05 0x00. */
 855   if (!(result == ASN1_ELEMENT_NOT_FOUND ||
 856         (result == ASN1_SUCCESS && len == ASN1_NULL_SIZE &&
 857          memcmp (str, ASN1_NULL, ASN1_NULL_SIZE) == 0)))
 858     {
 859       gnutls_assert ();
 860       asn1_delete_structure (&dinfo);
 861       return GNUTLS_E_ASN1_GENERIC_ERROR;
 862     }
 863
 864   len = *digest_size;
 865   result = asn1_read_value (dinfo, "digest", digest, &len);
 866
 867   if (result != ASN1_SUCCESS)
 868     {
 869       gnutls_assert ();
 870       *digest_size = len;
 871       asn1_delete_structure (&dinfo);
 872       return _gnutls_asn2err (result);
 873     }
 874
 875   *digest_size = len;
 876   asn1_delete_structure (&dinfo);
 877
 878   return 0;
 879 }
 880
 881 /* Writes the digest information and the digest in a DER encoded
 882  * structure. The digest info is allocated and stored into the info structure.
 883  */
 884 static int
 885 encode_ber_digest_info (gnutls_digest_algorithm_t hash,
 886                         const gnutls_datum_t * digest,
 887                         gnutls_datum_t * output)
 888 {
 889   ASN1_TYPE dinfo = ASN1_TYPE_EMPTY;
 890   int result;
 891   const char *algo;
 892   uint8_t *tmp_output;
 893   int tmp_output_size;
 894
 895   algo = _gnutls_x509_mac_to_oid ((gnutls_mac_algorithm_t) hash);
 896   if (algo == NULL)
 897     {
 898       gnutls_assert ();
 899       _gnutls_debug_log ("Hash algorithm: %d has no OID\n", hash);
 900       return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
 901     }
 902
 903   if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
 904                                      "GNUTLS.DigestInfo",
 905                                      &dinfo)) != ASN1_SUCCESS)
 906     {
 907       gnutls_assert ();
 908       return _gnutls_asn2err (result);
 909     }
 910
 911   result = asn1_write_value (dinfo, "digestAlgorithm.algorithm", algo, 1);
 912   if (result != ASN1_SUCCESS)
 913     {
 914       gnutls_assert ();
 915       asn1_delete_structure (&dinfo);
 916       return _gnutls_asn2err (result);
 917     }
 918
 919   /* Write an ASN.1 NULL in the parameters field.  This matches RFC
 920      3279 and RFC 4055, although is arguable incorrect from a historic
 921      perspective (see those documents for more information).
 922      Regardless of what is correct, this appears to be what most
 923      implementations do.  */
 924   result = asn1_write_value (dinfo, "digestAlgorithm.parameters",
 925                              ASN1_NULL, ASN1_NULL_SIZE);
 926   if (result != ASN1_SUCCESS)
 927     {
 928       gnutls_assert ();
 929       asn1_delete_structure (&dinfo);
 930       return _gnutls_asn2err (result);
 931     }
 932
 933   result = asn1_write_value (dinfo, "digest", digest->data, digest->size);
 934   if (result != ASN1_SUCCESS)
 935     {
 936       gnutls_assert ();
 937       asn1_delete_structure (&dinfo);
 938       return _gnutls_asn2err (result);
 939     }
 940
 941   tmp_output_size = 0;
 942   asn1_der_coding (dinfo, "", NULL, &tmp_output_size, NULL);
 943
 944   tmp_output = gnutls_malloc (tmp_output_size);
 945   if (tmp_output == NULL)
 946     {
 947       gnutls_assert ();
 948       asn1_delete_structure (&dinfo);
 949       return GNUTLS_E_MEMORY_ERROR;
 950     }
 951
 952   result = asn1_der_coding (dinfo, "", tmp_output, &tmp_output_size, NULL);
 953   if (result != ASN1_SUCCESS)
 954     {
 955       gnutls_assert ();
 956       asn1_delete_structure (&dinfo);
 957       return _gnutls_asn2err (result);
 958     }
 959
 960   asn1_delete_structure (&dinfo);
 961
 962   output->size = tmp_output_size;
 963   output->data = tmp_output;
 964
 965   return 0;
 966 }