mirror of https://github.com/moparisthebest/mail
247 lines
7.4 KiB
JavaScript
247 lines
7.4 KiB
JavaScript
/**
|
|
* Javascript implementation of PKCS#1 PSS signature padding.
|
|
*
|
|
* @author Stefan Siegl
|
|
*
|
|
* Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
|
|
*/
|
|
(function() {
|
|
/* ########## Begin module implementation ########## */
|
|
function initModule(forge) {
|
|
|
|
// shortcut for PSS API
|
|
var pss = forge.pss = forge.pss || {};
|
|
|
|
/**
|
|
* Creates a PSS signature scheme object.
|
|
*
|
|
* @param hash hash function to use, a Forge md instance
|
|
* @param mgf mask generation function to use, a Forge mgf instance
|
|
* @param sLen length of the salt in octets
|
|
* @return a signature scheme object.
|
|
*/
|
|
pss.create = function(hash, mgf, sLen) {
|
|
var hLen = hash.digestLength;
|
|
var pssobj = {};
|
|
|
|
/**
|
|
* Verify PSS signature
|
|
*
|
|
* This function implements EMSA-PSS-VERIFY as per RFC 3447, section 9.1.2
|
|
*
|
|
* @param {String} mHash The message digest hash to compare against
|
|
* the signature.
|
|
* @param {String} em The encoded message (RSA decryption result).
|
|
* @param modsBits Length of the RSA modulus in bits.
|
|
* @return true if the signature was verified, false if not.
|
|
*/
|
|
pssobj.verify = function(mHash, em, modBits) {
|
|
var i;
|
|
var emBits = modBits - 1;
|
|
var emLen = Math.ceil(emBits / 8);
|
|
|
|
/* c. Convert the message representative m to an encoded message EM
|
|
* of length emLen = ceil((modBits - 1) / 8) octets, where modBits
|
|
* is the length in bits of the RSA modulus n */
|
|
em = em.substr(-emLen);
|
|
|
|
/* 3. If emLen < hLen + sLen + 2, output "inconsistent" and stop. */
|
|
if(emLen < hLen + sLen + 2) {
|
|
throw {
|
|
message: 'Inconsistent parameters to PSS signature verification.'
|
|
};
|
|
}
|
|
|
|
/* 4. If the rightmost octet of EM does not have hexadecimal value
|
|
* 0xbc, output "inconsistent" and stop. */
|
|
if(em.charCodeAt(emLen - 1) !== 0xbc) {
|
|
throw {
|
|
message: 'Encoded message does not end in 0xBC.'
|
|
};
|
|
}
|
|
|
|
/* 5. Let maskedDB be the leftmost emLen - hLen - 1 octets of EM, and
|
|
* let H be the next hLen octets. */
|
|
var maskLen = emLen - hLen - 1;
|
|
var maskedDB = em.substr(0, maskLen);
|
|
var h = em.substr(maskLen, hLen);
|
|
|
|
/* 6. If the leftmost 8emLen - emBits bits of the leftmost octet in
|
|
* maskedDB are not all equal to zero, output "inconsistent" and stop. */
|
|
var mask = (0xFF00 >> (8 * emLen - emBits)) & 0xFF;
|
|
if((maskedDB.charCodeAt(0) & mask) !== 0) {
|
|
throw {
|
|
message: 'Bits beyond keysize not zero as expected.'
|
|
};
|
|
}
|
|
|
|
/* 7. Let dbMask = MGF(H, emLen - hLen - 1). */
|
|
var dbMask = mgf.generate(h, maskLen);
|
|
|
|
/* 8. Let DB = maskedDB \xor dbMask. */
|
|
var db = '';
|
|
for(i = 0; i < maskLen; i ++) {
|
|
db += String.fromCharCode(maskedDB.charCodeAt(i) ^ dbMask.charCodeAt(i));
|
|
}
|
|
|
|
/* 9. Set the leftmost 8emLen - emBits bits of the leftmost octet
|
|
* in DB to zero. */
|
|
db = String.fromCharCode(db.charCodeAt(0) & ~mask) + db.substr(1);
|
|
|
|
/* 10. If the emLen - hLen - sLen - 2 leftmost octets of DB are not zero
|
|
* or if the octet at position emLen - hLen - sLen - 1 (the leftmost
|
|
* position is "position 1") does not have hexadecimal value 0x01,
|
|
* output "inconsistent" and stop. */
|
|
var checkLen = emLen - hLen - sLen - 2;
|
|
for(i = 0; i < checkLen; i ++) {
|
|
if(db.charCodeAt(i) !== 0x00) {
|
|
throw {
|
|
message: 'Leftmost octets not zero as expected'
|
|
};
|
|
}
|
|
}
|
|
|
|
if(db.charCodeAt(checkLen) !== 0x01) {
|
|
throw {
|
|
message: 'Inconsistent PSS signature, 0x01 marker not found'
|
|
};
|
|
}
|
|
|
|
/* 11. Let salt be the last sLen octets of DB. */
|
|
var salt = db.substr(-sLen);
|
|
|
|
/* 12. Let M' = (0x)00 00 00 00 00 00 00 00 || mHash || salt */
|
|
var m_ = new forge.util.ByteBuffer();
|
|
m_.fillWithByte(0, 8);
|
|
m_.putBytes(mHash);
|
|
m_.putBytes(salt);
|
|
|
|
/* 13. Let H' = Hash(M'), an octet string of length hLen. */
|
|
hash.start();
|
|
hash.update(m_.getBytes());
|
|
var h_ = hash.digest().getBytes();
|
|
|
|
/* 14. If H = H', output "consistent." Otherwise, output "inconsistent." */
|
|
return h === h_;
|
|
};
|
|
|
|
/**
|
|
* Encode PSS signature.
|
|
*
|
|
* This function implements EMSA-PSS-ENCODE as per RFC 3447, section 9.1.1
|
|
*
|
|
* @param md the message digest object with the hash to sign.
|
|
* @param modsBits Length of the RSA modulus in bits.
|
|
* @return the encoded message, string of length ceil((modBits - 1) / 8)
|
|
*/
|
|
pssobj.encode = function(md, modBits) {
|
|
var i;
|
|
var emBits = modBits - 1;
|
|
var emLen = Math.ceil(emBits / 8);
|
|
|
|
/* 2. Let mHash = Hash(M), an octet string of length hLen. */
|
|
var mHash = md.digest().getBytes();
|
|
|
|
/* 3. If emLen < hLen + sLen + 2, output "encoding error" and stop. */
|
|
if(emLen < hLen + sLen + 2) {
|
|
throw {
|
|
message: 'Message is too long to encrypt'
|
|
};
|
|
}
|
|
|
|
/* 4. Generate a random octet string salt of length sLen; if sLen = 0,
|
|
* then salt is the empty string. */
|
|
var salt = forge.random.getBytes(sLen);
|
|
|
|
/* 5. Let M' = (0x)00 00 00 00 00 00 00 00 || mHash || salt; */
|
|
var m_ = new forge.util.ByteBuffer();
|
|
m_.fillWithByte(0, 8);
|
|
m_.putBytes(mHash);
|
|
m_.putBytes(salt);
|
|
|
|
/* 6. Let H = Hash(M'), an octet string of length hLen. */
|
|
hash.start();
|
|
hash.update(m_.getBytes());
|
|
var h = hash.digest().getBytes();
|
|
|
|
/* 7. Generate an octet string PS consisting of emLen - sLen - hLen - 2
|
|
* zero octets. The length of PS may be 0. */
|
|
var ps = new forge.util.ByteBuffer();
|
|
ps.fillWithByte(0, emLen - sLen - hLen - 2);
|
|
|
|
/* 8. Let DB = PS || 0x01 || salt; DB is an octet string of length
|
|
* emLen - hLen - 1. */
|
|
ps.putByte(0x01);
|
|
ps.putBytes(salt);
|
|
var db = ps.getBytes();
|
|
|
|
/* 9. Let dbMask = MGF(H, emLen - hLen - 1). */
|
|
var maskLen = emLen - hLen - 1;
|
|
var dbMask = mgf.generate(h, maskLen);
|
|
|
|
/* 10. Let maskedDB = DB \xor dbMask. */
|
|
var maskedDB = '';
|
|
for(i = 0; i < maskLen; i ++) {
|
|
maskedDB += String.fromCharCode(db.charCodeAt(i) ^ dbMask.charCodeAt(i));
|
|
}
|
|
|
|
/* 11. Set the leftmost 8emLen - emBits bits of the leftmost octet in
|
|
* maskedDB to zero. */
|
|
var mask = (0xFF00 >> (8 * emLen - emBits)) & 0xFF;
|
|
maskedDB = String.fromCharCode(maskedDB.charCodeAt(0) & ~mask) +
|
|
maskedDB.substr(1);
|
|
|
|
/* 12. Let EM = maskedDB || H || 0xbc.
|
|
* 13. Output EM. */
|
|
return maskedDB + h + String.fromCharCode(0xbc);
|
|
};
|
|
|
|
return pssobj;
|
|
};
|
|
|
|
} // end module implementation
|
|
|
|
/* ########## Begin module wrapper ########## */
|
|
var name = 'pss';
|
|
var deps = ['./random', './util'];
|
|
var nodeDefine = null;
|
|
if(typeof define !== 'function') {
|
|
// NodeJS -> AMD
|
|
if(typeof module === 'object' && module.exports) {
|
|
nodeDefine = function(ids, factory) {
|
|
factory(require, module);
|
|
};
|
|
}
|
|
// <script>
|
|
else {
|
|
if(typeof forge === 'undefined') {
|
|
forge = {};
|
|
}
|
|
initModule(forge);
|
|
}
|
|
}
|
|
// AMD
|
|
if(nodeDefine || typeof define === 'function') {
|
|
// define module AMD style
|
|
(nodeDefine || define)(['require', 'module'].concat(deps),
|
|
function(require, module) {
|
|
module.exports = function(forge) {
|
|
var mods = deps.map(function(dep) {
|
|
return require(dep);
|
|
}).concat(initModule);
|
|
// handle circular dependencies
|
|
forge = forge || {};
|
|
forge.defined = forge.defined || {};
|
|
if(forge.defined[name]) {
|
|
return forge[name];
|
|
}
|
|
forge.defined[name] = true;
|
|
for(var i = 0; i < mods.length; ++i) {
|
|
mods[i](forge);
|
|
}
|
|
return forge[name];
|
|
};
|
|
});
|
|
}
|
|
})();
|