pkcs11_softtoken/common/softRSA.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2003, 2012, Oracle and/or its affiliates. All rights reserved.
 */

#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <sys/types.h>
#include <security/cryptoki.h>
#include <cryptoutil.h>
#include "softGlobal.h"
#include "softSession.h"
#include "softObject.h"
#include "softOps.h"
#include "softRSA.h"
#include "softMAC.h"
#include "softCrypt.h"

CK_RV
soft_rsa_encrypt(soft_object_t *key, CK_BYTE_PTR in, uint32_t in_len,
    CK_BYTE_PTR out, int realpublic)
{

    CK_RV rv = CKR_OK;

/* EXPORT DELETE START */

    uchar_t expo[MAX_KEY_ATTR_BUFLEN];
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t expo_len = sizeof (expo);
    uint32_t modulus_len = sizeof (modulus);
    RSAbytekey k;

    if (realpublic) {
        rv = soft_get_public_value(key, CKA_PUBLIC_EXPONENT, expo,
            &expo_len);
        if (rv != CKR_OK) {
            goto clean1;
        }
    } else {
        rv = soft_get_private_value(key, CKA_PRIVATE_EXPONENT, expo,
            &expo_len);
        if (rv != CKR_OK) {
            goto clean1;
        }
    }

    rv = soft_get_public_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean1;
    }

    k.modulus = modulus;
    k.modulus_bits = CRYPTO_BYTES2BITS(modulus_len);
    k.pubexpo = expo;
    k.pubexpo_bytes = expo_len;
    k.rfunc = NULL;

    rv = rsa_encrypt(&k, in, in_len, out);

clean1:

/* EXPORT DELETE END */

    return (rv);
}


CK_RV
soft_rsa_decrypt(soft_object_t *key, CK_BYTE_PTR in, uint32_t in_len,
    CK_BYTE_PTR out)
{

    CK_RV rv = CKR_OK;

/* EXPORT DELETE START */

    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uchar_t prime1[MAX_KEY_ATTR_BUFLEN];
    uchar_t prime2[MAX_KEY_ATTR_BUFLEN];
    uchar_t expo1[MAX_KEY_ATTR_BUFLEN];
    uchar_t expo2[MAX_KEY_ATTR_BUFLEN];
    uchar_t coef[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    uint32_t prime1_len = sizeof (prime1);
    uint32_t prime2_len = sizeof (prime2);
    uint32_t expo1_len = sizeof (expo1);
    uint32_t expo2_len = sizeof (expo2);
    uint32_t coef_len = sizeof (coef);
    RSAbytekey k;

    rv = soft_get_private_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean1;
    }

    rv = soft_get_private_value(key, CKA_PRIME_1, prime1, &prime1_len);

    if ((prime1_len == 0) && (rv == CKR_OK)) {
        rv = soft_rsa_encrypt(key, in, in_len, out, 0);
        goto clean1;
    } else {
        if (rv != CKR_OK)
            goto clean1;
    }

    rv = soft_get_private_value(key, CKA_PRIME_2, prime2, &prime2_len);

    if ((prime2_len == 0) && (rv == CKR_OK)) {
        rv = soft_rsa_encrypt(key, in, in_len, out, 0);
        goto clean1;
    } else {
        if (rv != CKR_OK)
            goto clean1;
    }

    rv = soft_get_private_value(key, CKA_EXPONENT_1, expo1, &expo1_len);

    if ((expo1_len == 0) && (rv == CKR_OK)) {
        rv = soft_rsa_encrypt(key, in, in_len, out, 0);
        goto clean1;
    } else {
        if (rv != CKR_OK)
            goto clean1;
    }

    rv = soft_get_private_value(key, CKA_EXPONENT_2, expo2, &expo2_len);

    if ((expo2_len == 0) && (rv == CKR_OK)) {
        rv = soft_rsa_encrypt(key, in, in_len, out, 0);
        goto clean1;
    } else {
        if (rv != CKR_OK)
            goto clean1;
    }

    rv = soft_get_private_value(key, CKA_COEFFICIENT, coef, &coef_len);

    if ((coef_len == 0) && (rv == CKR_OK)) {
        rv = soft_rsa_encrypt(key, in, in_len, out, 0);
        goto clean1;
    } else {
        if (rv != CKR_OK)
            goto clean1;
    }

    k.modulus = modulus;
    k.modulus_bits = CRYPTO_BYTES2BITS(modulus_len);
    k.prime1 = prime1;
    k.prime1_bytes = prime1_len;
    k.prime2 = prime2;
    k.prime2_bytes = prime2_len;
    k.expo1 = expo1;
    k.expo1_bytes = expo1_len;
    k.expo2 = expo2;
    k.expo2_bytes = expo2_len;
    k.coeff = coef;
    k.coeff_bytes = coef_len;
    k.rfunc = NULL;

    rv = rsa_decrypt(&k, in, in_len, out);

clean1:

/* EXPORT DELETE END */

    return (rv);
}

/*
 * Allocate a RSA context for the active encryption or decryption operation.
 * This function is called without the session lock held.
 */
CK_RV
soft_rsa_crypt_init_common(soft_session_t *session_p,
    CK_MECHANISM_PTR pMechanism, soft_object_t *key_p,
    soft_session_op_t op)
{

    soft_rsa_ctx_t *rsa_ctx;
    soft_object_t *tmp_key = NULL;
    CK_RV rv;

    rsa_ctx = calloc(1, sizeof (soft_rsa_ctx_t));
    if (rsa_ctx == NULL) {
        return (CKR_HOST_MEMORY);
    }

    /*
     * Make a copy of the encryption or decryption key, and save it
     * in the RSA crypto context since it will be used later for
     * encryption/decryption. We don't want to hold any object reference
     * on this original key while doing encryption/decryption.
     */
    (void) pthread_rwlock_rdlock(&key_p->object_rwlock);
    rv = soft_copy_object(key_p, &tmp_key, SOFT_COPY_OBJ_ORIG_SH,
        NULL);

    if ((rv != CKR_OK) || (tmp_key == NULL)) {
        /* Most likely we ran out of space. */
        (void) pthread_rwlock_unlock(&key_p->object_rwlock);
        free(rsa_ctx);
        return (rv);
    }

    /* No need to hold the lock on the old object. */
    (void) pthread_rwlock_unlock(&key_p->object_rwlock);
    rsa_ctx->key = tmp_key;

    soft_set_session_context(session_p, op, rsa_ctx, pMechanism);

    return (CKR_OK);
}

CK_RV
soft_rsa_encrypt_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pEncrypted,
    CK_ULONG_PTR pulEncryptedLen, CK_MECHANISM_TYPE mechanism)
{

    soft_rsa_ctx_t *rsa_ctx = session_p->encrypt.context;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_BYTE plain_data[MAX_RSA_KEYLENGTH_IN_BYTES];
    CK_BYTE cipher_data[MAX_RSA_KEYLENGTH_IN_BYTES];
    CK_RV rv = CKR_OK;

    rv = soft_get_public_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (pEncrypted == NULL) {
        /*
         * Application asks for the length of the output buffer
         * to hold the ciphertext.
         */
        *pulEncryptedLen = modulus_len;
        rv = CKR_OK;
        goto clean1;
    }

    if (mechanism == CKM_RSA_PKCS) {
        /*
         * Input data length needs to be <=
         * modulus length-MIN_PKCS1_PADLEN.
         */
        if (ulDataLen > ((CK_ULONG)modulus_len - MIN_PKCS1_PADLEN)) {
            *pulEncryptedLen = modulus_len;
            rv = CKR_DATA_LEN_RANGE;
            goto clean_exit;
        }
    } else {
        /* Input data length needs to be <= modulus length. */
        if (ulDataLen > (CK_ULONG)modulus_len) {
            *pulEncryptedLen = modulus_len;
            rv = CKR_DATA_LEN_RANGE;
            goto clean_exit;
        }
    }

    /* Is the application-supplied buffer large enough? */
    if (*pulEncryptedLen < (CK_ULONG)modulus_len) {
        *pulEncryptedLen = modulus_len;
        rv = CKR_BUFFER_TOO_SMALL;
        goto clean1;
    }

    if (mechanism == CKM_RSA_PKCS) {
        /*
         * Add PKCS padding to the input data to format a block
         * type "02" encryption block.
         */
        rv = pkcs1_encode(PKCS1_ENCRYPT, pData, ulDataLen, plain_data,
            modulus_len);

        if (rv != CKR_OK)
            goto clean_exit;
    } else {
        /* Pad zeros for the leading bytes of the input data. */
        (void) memset(plain_data, 0x0, modulus_len - ulDataLen);
        (void) memcpy(&plain_data[modulus_len - ulDataLen], pData,
            ulDataLen);
    }

    rv = soft_rsa_encrypt(key, plain_data, modulus_len, cipher_data, 1);
    if (rv == CKR_OK) {
        (void) memcpy(pEncrypted, cipher_data, modulus_len);
        *pulEncryptedLen = modulus_len;
    }

clean_exit:
    soft_clear_session_context(session_p, SOFT_ENCRYPT_OP,
        sizeof (soft_rsa_ctx_t));

    soft_cleanup_object(key);
    free(key);
clean1:
    return (rv);
}


CK_RV
soft_rsa_decrypt_common(soft_session_t *session_p, CK_BYTE_PTR pEncrypted,
    CK_ULONG ulEncryptedLen, CK_BYTE_PTR pData,
    CK_ULONG_PTR pulDataLen, CK_MECHANISM_TYPE mechanism)
{

    soft_rsa_ctx_t *rsa_ctx = session_p->decrypt.context;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_BYTE plain_data[MAX_RSA_KEYLENGTH_IN_BYTES];
    CK_RV rv = CKR_OK;

    rv = soft_get_private_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (ulEncryptedLen != (CK_ULONG)modulus_len) {
        rv = CKR_ENCRYPTED_DATA_LEN_RANGE;
        goto clean_exit;
    }

    if (pData == NULL) {
        /*
         * Application asks for the length of the output buffer
         * to hold the recovered data.
         */
        *pulDataLen = modulus_len;
        rv = CKR_OK;
        goto clean1;
    }

    if (mechanism == CKM_RSA_X_509) {
        if (*pulDataLen < (CK_ULONG)modulus_len) {
            *pulDataLen = modulus_len;
            rv = CKR_BUFFER_TOO_SMALL;
            goto clean1;
        }
    }

    rv = soft_rsa_decrypt(key, pEncrypted, modulus_len, plain_data);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (mechanism == CKM_RSA_PKCS) {
        size_t plain_len = modulus_len;
        size_t num_padding;

        /* Strip off the PKCS block formatting data. */
        rv = pkcs1_decode(PKCS1_DECRYPT, plain_data, &plain_len);
        if (rv != CKR_OK)
            goto clean_exit;

        num_padding = modulus_len - plain_len;
        if (ulEncryptedLen - num_padding > *pulDataLen) {
            *pulDataLen = plain_len;
            rv = CKR_BUFFER_TOO_SMALL;
            goto clean1;
        }

        (void) memcpy(pData, &plain_data[num_padding], plain_len);
        *pulDataLen = plain_len;
    } else {
        (void) memcpy(pData, plain_data, modulus_len);
        *pulDataLen = modulus_len;
    }

clean_exit:
    soft_clear_session_context(session_p, SOFT_DECRYPT_OP,
        sizeof (soft_rsa_ctx_t));

    soft_cleanup_object(key);
    free(key);

clean1:
    return (rv);
}

/*
 * Allocate a RSA context for the active sign or verify operation.
 * This function is called without the session lock held.
 */
CK_RV
soft_rsa_sign_verify_init_common(soft_session_t *session_p,
    CK_MECHANISM_PTR pMechanism, soft_object_t *key_p,
    boolean_t sign)
{
    CK_RV rv = CKR_OK;
    soft_rsa_ctx_t *rsa_ctx;
    CK_MECHANISM digest_mech;
    soft_object_t *tmp_key = NULL;

    if (sign) {
        if ((key_p->class != CKO_PRIVATE_KEY) ||
            (key_p->key_type != CKK_RSA))
            return (CKR_KEY_TYPE_INCONSISTENT);
    } else {
        if ((key_p->class != CKO_PUBLIC_KEY) ||
            (key_p->key_type != CKK_RSA))
            return (CKR_KEY_TYPE_INCONSISTENT);
    }

    switch (pMechanism->mechanism) {
    case CKM_MD5_RSA_PKCS:
        digest_mech.mechanism = CKM_MD5;
        break;

    case CKM_SHA1_RSA_PKCS:
        digest_mech.mechanism = CKM_SHA_1;
        digest_mech.pParameter = pMechanism->pParameter;
        digest_mech.ulParameterLen = pMechanism->ulParameterLen;
        break;

    case CKM_SHA224_RSA_PKCS:
        digest_mech.mechanism = CKM_SHA224;
        break;

    case CKM_SHA256_RSA_PKCS:
        digest_mech.mechanism = CKM_SHA256;
        break;

    case CKM_SHA384_RSA_PKCS:
        digest_mech.mechanism = CKM_SHA384;
        break;

    case CKM_SHA512_RSA_PKCS:
        digest_mech.mechanism = CKM_SHA512;
        break;

    /* These mechs are not digested, so don't set digest_mech */
    case CKM_RSA_PKCS:
    case CKM_RSA_X_509:
        digest_mech.mechanism = 0;
        break;

    default:
        return (CKR_MECHANISM_INVALID);
    }

    if (digest_mech.mechanism != 0) {
        rv = soft_digest_init_internal(session_p, &digest_mech);
        if (rv != CKR_OK)
            return (rv);
    }

    rsa_ctx = malloc(sizeof (soft_rsa_ctx_t));

    if (rsa_ctx == NULL) {
        rv = CKR_HOST_MEMORY;
        goto clean_exit;
    }

    (void) pthread_rwlock_rdlock(&key_p->object_rwlock);
    rv = soft_copy_object(key_p, &tmp_key, SOFT_COPY_OBJ_ORIG_SH,
        NULL);

    if ((rv != CKR_OK) || (tmp_key == NULL)) {
        /* Most likely we ran out of space. */
        (void) pthread_rwlock_unlock(&key_p->object_rwlock);
        free(rsa_ctx);
        goto clean_exit;
    }

    /* No need to hold the lock on the old object. */
    (void) pthread_rwlock_unlock(&key_p->object_rwlock);
    rsa_ctx->key = tmp_key;

    (void) pthread_mutex_lock(&session_p->session_mutex);

    if (sign) {
        session_p->sign.context = rsa_ctx;
        session_p->sign.mech.mechanism = pMechanism->mechanism;
    } else {
        session_p->verify.context = rsa_ctx;
        session_p->verify.mech.mechanism = pMechanism->mechanism;
    }

    (void) pthread_mutex_unlock(&session_p->session_mutex);

    return (CKR_OK);

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    if (session_p->digest.context != NULL) {
        free(session_p->digest.context);
        session_p->digest.context = NULL;
        session_p->digest.flags = 0;
    }
    (void) pthread_mutex_unlock(&session_p->session_mutex);
    return (rv);

}


CK_RV
soft_rsa_sign_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG_PTR pulSignedLen, CK_MECHANISM_TYPE mechanism)
{

    CK_RV rv = CKR_OK;
    soft_rsa_ctx_t *rsa_ctx = session_p->sign.context;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_BYTE plain_data[MAX_RSA_KEYLENGTH_IN_BYTES];
    CK_BYTE signed_data[MAX_RSA_KEYLENGTH_IN_BYTES];

    rv = soft_get_private_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (pSigned == NULL) {
        /* Application asks for the length of the output buffer. */
        *pulSignedLen = modulus_len;
        rv = CKR_OK;
        goto clean1;
    }

    switch (mechanism) {

    case CKM_RSA_PKCS:

        /*
         * Input data length needs to be <=
         * modulus length-MIN_PKCS1_PADLEN.
         */
        if (ulDataLen > ((CK_ULONG)modulus_len - MIN_PKCS1_PADLEN)) {
            *pulSignedLen = modulus_len;
            rv = CKR_DATA_LEN_RANGE;
            goto clean_exit;
        }
        break;

    case CKM_RSA_X_509:

        /* Input data length needs to be <= modulus length. */
        if (ulDataLen > (CK_ULONG)modulus_len) {
            *pulSignedLen = modulus_len;
            rv = CKR_DATA_LEN_RANGE;
            goto clean_exit;
        }
        break;
    }

    /* Is the application-supplied buffer large enough? */
    if (*pulSignedLen < (CK_ULONG)modulus_len) {
        *pulSignedLen = modulus_len;
        rv = CKR_BUFFER_TOO_SMALL;
        goto clean1;
    }

    switch (mechanism) {

    case CKM_RSA_PKCS:
    case CKM_MD5_RSA_PKCS:
    case CKM_SHA1_RSA_PKCS:
    case CKM_SHA224_RSA_PKCS:
    case CKM_SHA256_RSA_PKCS:
    case CKM_SHA384_RSA_PKCS:
    case CKM_SHA512_RSA_PKCS:
        /*
         * Add PKCS padding to the input data to format a block
         * type "01" encryption block.
         */
        rv = pkcs1_encode(PKCS1_SIGN, pData, ulDataLen, plain_data,
            modulus_len);

        if (rv != CKR_OK) {
            goto clean_exit;
        }
        break;

    case CKM_RSA_X_509:

        /* Pad zeros for the leading bytes of the input data. */
        (void) memset(plain_data, 0x0, modulus_len - ulDataLen);
        (void) memcpy(&plain_data[modulus_len - ulDataLen], pData,
            ulDataLen);
        break;
    }

    /*
     * Perform RSA encryption with the signer's RSA private key
     * for signature process.
     */
    rv = soft_rsa_decrypt(key, plain_data, modulus_len, signed_data);

    if (rv == CKR_OK) {
        (void) memcpy(pSigned, signed_data, modulus_len);
        *pulSignedLen = modulus_len;
    }

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    free(session_p->sign.context);
    session_p->sign.context = NULL;
    if (session_p->digest.context != NULL) {
        free(session_p->digest.context);
        session_p->digest.context = NULL;
        session_p->digest.flags = 0;
    }
    (void) pthread_mutex_unlock(&session_p->session_mutex);
    soft_cleanup_object(key);
    free(key);

clean1:
    return (rv);
}


CK_RV
soft_rsa_verify_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
    CK_ULONG ulSignatureLen, CK_MECHANISM_TYPE mechanism)
{

    CK_RV rv = CKR_OK;
    soft_rsa_ctx_t *rsa_ctx = session_p->verify.context;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_BYTE plain_data[MAX_RSA_KEYLENGTH_IN_BYTES];

    rv = soft_get_public_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (ulDataLen == 0) {
        rv = CKR_DATA_LEN_RANGE;
        goto clean_exit;
    }

    if (ulSignatureLen != (CK_ULONG)modulus_len) {
        rv = CKR_SIGNATURE_LEN_RANGE;
        goto clean_exit;
    }

    /*
     * Perform RSA decryption with the signer's RSA public key
     * for verification process.
     */
    rv = soft_rsa_encrypt(key, pSignature, modulus_len, plain_data, 1);
    if (rv == CKR_OK) {
        switch (mechanism) {

        case CKM_RSA_PKCS:
        case CKM_MD5_RSA_PKCS:
        case CKM_SHA1_RSA_PKCS:
        case CKM_SHA224_RSA_PKCS:
        case CKM_SHA256_RSA_PKCS:
        case CKM_SHA384_RSA_PKCS:
        case CKM_SHA512_RSA_PKCS:
        {
            /*
             * Strip off the encoded padding bytes in front of the
             * recovered data, then compare the recovered data with
             * the original data.
             */
            size_t data_len = modulus_len;

            rv = pkcs1_decode(PKCS1_VERIFY, plain_data, &data_len);
            if (rv != CKR_OK) {
                goto clean_exit;
            }

            if ((CK_ULONG)data_len != ulDataLen) {
                rv = CKR_DATA_LEN_RANGE;
                goto clean_exit;
            } else if (memcmp(pData,
                &plain_data[modulus_len - data_len],
                ulDataLen) != 0) {
                rv = CKR_SIGNATURE_INVALID;
                goto clean_exit;
            }
            break;
        }

        case CKM_RSA_X_509:
            /*
             * Strip off the encoded padding bytes in front of the
             * recovered plain_data, then compare the input data
             * with the recovered data.
             */
            if (memcmp(pData,
                plain_data + ulSignatureLen - ulDataLen,
                ulDataLen) != 0) {
                rv = CKR_SIGNATURE_INVALID;
                goto clean_exit;
            }
            break;
        }
    }

    if (rv == CKR_DATA_LEN_RANGE) {
        if ((mechanism == CKM_MD5_RSA_PKCS) ||
            (mechanism == CKM_SHA1_RSA_PKCS) ||
            (mechanism == CKM_SHA224_RSA_PKCS) ||
            (mechanism == CKM_SHA256_RSA_PKCS) ||
            (mechanism == CKM_SHA384_RSA_PKCS) ||
            (mechanism == CKM_SHA512_RSA_PKCS))
            rv = CKR_SIGNATURE_INVALID;
    }

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    free(session_p->verify.context);
    session_p->verify.context = NULL;
    if (session_p->digest.context != NULL) {
        free(session_p->digest.context);
        session_p->digest.context = NULL;
        session_p->digest.flags = 0;
    }
    (void) pthread_mutex_unlock(&session_p->session_mutex);
    soft_cleanup_object(key);
    free(key);
    return (rv);
}

CK_RV
soft_genRSAkey_set_attribute(soft_object_t *key, CK_ATTRIBUTE_TYPE type,
    uchar_t *buf, uint32_t buflen, boolean_t public)
{
    CK_RV rv = CKR_OK;
    biginteger_t *dst = NULL;
    biginteger_t src;

    switch (type) {

    case CKA_MODULUS:

        if (public)
            dst = OBJ_PUB_RSA_MOD(key);
        else
            dst = OBJ_PRI_RSA_MOD(key);
        break;

    case CKA_PUBLIC_EXPONENT:

        if (public)
            dst = OBJ_PUB_RSA_PUBEXPO(key);
        else
            dst = OBJ_PRI_RSA_PUBEXPO(key);
        break;

    case CKA_PRIVATE_EXPONENT:

        dst = OBJ_PRI_RSA_PRIEXPO(key);
        break;

    case CKA_PRIME_1:

        dst = OBJ_PRI_RSA_PRIME1(key);
        break;

    case CKA_PRIME_2:

        dst = OBJ_PRI_RSA_PRIME2(key);
        break;

    case CKA_EXPONENT_1:

        dst = OBJ_PRI_RSA_EXPO1(key);
        break;

    case CKA_EXPONENT_2:

        dst = OBJ_PRI_RSA_EXPO2(key);
        break;

    case CKA_COEFFICIENT:

        dst = OBJ_PRI_RSA_COEF(key);
        break;
    }

    /* Note: no explanation found for why this is needed */
    while (buf[0] == 0) {   /* remove proceeding 0x00 */
        buf++;
        buflen--;
    }

    if ((rv = dup_bigint_attr(&src, buf, buflen)) != CKR_OK)
        goto cleanexit;

    /* Copy the attribute in the key object. */
    copy_bigint_attr(&src, dst);

cleanexit:
    return (rv);

}


CK_RV
soft_rsa_genkey_pair(soft_object_t *pubkey, soft_object_t *prikey)
{
    CK_RV rv = CKR_OK;
    CK_ATTRIBUTE template;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len;
    uchar_t pub_expo[MAX_KEY_ATTR_BUFLEN];
    uint32_t pub_expo_len = sizeof (pub_expo);
    uchar_t private_exponent[MAX_KEY_ATTR_BUFLEN];
    uint32_t private_exponent_len = sizeof (private_exponent);
    uchar_t prime1[MAX_KEY_ATTR_BUFLEN];
    uint32_t prime1_len = sizeof (prime1);
    uchar_t prime2[MAX_KEY_ATTR_BUFLEN];
    uint32_t prime2_len = sizeof (prime2);
    uchar_t exponent1[MAX_KEY_ATTR_BUFLEN];
    uint32_t exponent1_len = sizeof (exponent1);
    uchar_t exponent2[MAX_KEY_ATTR_BUFLEN];
    uint32_t exponent2_len = sizeof (exponent2);
    uchar_t coefficient[MAX_KEY_ATTR_BUFLEN];
    uint32_t coefficient_len = sizeof (coefficient);
    RSAbytekey k;

    if ((pubkey == NULL) || (prikey == NULL)) {
        return (CKR_ARGUMENTS_BAD);
    }

    template.pValue = malloc(sizeof (CK_ULONG));
    if (template.pValue == NULL) {
        return (CKR_HOST_MEMORY);
    }
    template.ulValueLen = sizeof (CK_ULONG);

    rv = get_ulong_attr_from_object(OBJ_PUB_RSA_MOD_BITS(pubkey),
        &template);
    if (rv != CKR_OK) {
        free(template.pValue);
        goto clean0;
    }

#ifdef  __sparcv9
    /* LINTED */
    modulus_len = (uint32_t)(*((CK_ULONG *)(template.pValue)));
#else   /* !__sparcv9 */
    modulus_len = *((CK_ULONG *)(template.pValue));
#endif  /* __sparcv9 */

    free(template.pValue);

    rv = soft_get_public_value(pubkey, CKA_PUBLIC_EXPONENT, pub_expo,
        &pub_expo_len);
    if (rv != CKR_OK) {
        goto clean0;
    }

    /* Inputs to RSA key pair generation */
    k.modulus_bits = modulus_len;       /* save modulus len in bits  */
    modulus_len = CRYPTO_BITS2BYTES(modulus_len);   /* convert to bytes */
    k.modulus = modulus;
    k.pubexpo = pub_expo;
    k.pubexpo_bytes = pub_expo_len;
    k.rfunc = (IS_TOKEN_OBJECT(pubkey) || IS_TOKEN_OBJECT(prikey)) ?
        pkcs11_get_random : pkcs11_get_urandom;

    /* Outputs from RSA key pair generation */
    k.privexpo = private_exponent;
    k.privexpo_bytes = private_exponent_len;
    k.prime1 = prime1;
    k.prime1_bytes = prime1_len;
    k.prime2 = prime2;
    k.prime2_bytes = prime2_len;
    k.expo1 = exponent1;
    k.expo1_bytes = exponent1_len;
    k.expo2 = exponent2;
    k.expo2_bytes = exponent2_len;
    k.coeff = coefficient;
    k.coeff_bytes = coefficient_len;

    rv = rsa_genkey_pair(&k);

    if (rv != CKR_OK) {
        goto clean0;
    }

    /*
     * Add modulus in public template, and add all eight key fields
     * in private template.
     */
    if ((rv = soft_genRSAkey_set_attribute(pubkey, CKA_MODULUS,
        modulus, CRYPTO_BITS2BYTES(k.modulus_bits), B_TRUE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_MODULUS,
        modulus, CRYPTO_BITS2BYTES(k.modulus_bits), B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_PRIVATE_EXPONENT,
        private_exponent, k.privexpo_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_PUBLIC_EXPONENT,
        pub_expo, k.pubexpo_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_PRIME_1,
        prime1, k.prime1_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_PRIME_2,
        prime2, k.prime2_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_EXPONENT_1,
        exponent1, k.expo1_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_EXPONENT_2,
        exponent2, k.expo2_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

    if ((rv = soft_genRSAkey_set_attribute(prikey, CKA_COEFFICIENT,
        coefficient, k.coeff_bytes, B_FALSE)) != CKR_OK) {
        goto clean0;
    }

clean0:
    return (rv);
}


CK_ULONG
get_rsa_sha1_prefix(CK_MECHANISM_PTR mech, CK_BYTE_PTR *prefix) {
    if (mech->pParameter == NULL) {
        *prefix = (CK_BYTE *)SHA1_DER_PREFIX;
        return (SHA1_DER_PREFIX_Len);
    }

    *prefix = (CK_BYTE *)SHA1_DER_PREFIX_OID;
    return (SHA1_DER_PREFIX_OID_Len);
}

CK_RV
soft_rsa_digest_sign_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG_PTR pulSignedLen, CK_MECHANISM_TYPE mechanism, boolean_t Final)
{

    CK_RV rv = CKR_OK;
    CK_BYTE hash[SHA512_DIGEST_LENGTH];  /* space enough for all mechs */
    CK_ULONG hash_len = SHA512_DIGEST_LENGTH;
    /* space enough for all mechs */
    CK_BYTE der_data[SHA512_DIGEST_LENGTH + SHA2_DER_PREFIX_Len];
    CK_ULONG der_data_len;
    soft_rsa_ctx_t *rsa_ctx = session_p->sign.context;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_ULONG der_len;
    CK_BYTE_PTR der_prefix;

    rv = soft_get_private_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        (void) pthread_mutex_lock(&session_p->session_mutex);
        free(session_p->digest.context);
        session_p->digest.context = NULL;
        session_p->digest.flags = 0;
        (void) pthread_mutex_unlock(&session_p->session_mutex);
        soft_cleanup_object(key);
        free(key);
        goto clean1;
    }

    /* Check arguments before performing message digest. */
    if (pSigned == NULL) {
        /* Application asks for the length of the output buffer. */
        *pulSignedLen = modulus_len;
        rv = CKR_OK;
        goto clean1;
    }

    /* Is the application-supplied buffer large enough? */
    if (*pulSignedLen < (CK_ULONG)modulus_len) {
        *pulSignedLen = modulus_len;
        rv = CKR_BUFFER_TOO_SMALL;
        goto clean1;
    }

    if (Final) {
        rv = soft_digest_final(session_p, hash, &hash_len);
    } else {
        rv = soft_digest(session_p, pData, ulDataLen, hash, &hash_len);
    }

    if (rv != CKR_OK) {
        /* free the signature key */
        soft_cleanup_object(key);
        free(key);
        goto clean_exit;
    }

    /*
     * Prepare the DER encoding of the DigestInfo value by setting it to:
     *  <MECH>_DER_PREFIX || H
     *
     * See rsa_impl.c for more details.
     */
    switch (session_p->digest.mech.mechanism) {
    case CKM_MD5:
        (void) memcpy(der_data, MD5_DER_PREFIX, MD5_DER_PREFIX_Len);
        (void) memcpy(der_data + MD5_DER_PREFIX_Len, hash, hash_len);
        der_data_len = MD5_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA_1:
        der_len = get_rsa_sha1_prefix(&(session_p->digest.mech),
            &der_prefix);
        (void) memcpy(der_data, der_prefix, der_len);
        (void) memcpy(der_data + der_len, hash, hash_len);
        der_data_len = der_len + hash_len;
        break;
    case CKM_SHA224:
        (void) memcpy(der_data, SHA224_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA256:
        (void) memcpy(der_data, SHA256_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA384:
        (void) memcpy(der_data, SHA384_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA512:
        (void) memcpy(der_data, SHA512_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    }

    /*
     * Now, we are ready to sign the DER_ENCODED data
     * soft_rsa_sign_common() will free the signature key.
     */
    rv = soft_rsa_sign_common(session_p, der_data, der_data_len,
        pSigned, pulSignedLen, mechanism);

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    /* soft_digest_common() has freed the digest context */
    session_p->digest.flags = 0;
    (void) pthread_mutex_unlock(&session_p->session_mutex);

clean1:
    return (rv);
}


CK_RV
soft_rsa_digest_verify_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG ulSignedLen, CK_MECHANISM_TYPE mechanism, boolean_t Final)
{

    CK_RV rv = CKR_OK;
    CK_BYTE hash[SHA512_DIGEST_LENGTH];  /* space for all mechs */
    CK_ULONG hash_len = SHA512_DIGEST_LENGTH;
    CK_BYTE der_data[SHA512_DIGEST_LENGTH + SHA2_DER_PREFIX_Len];
    CK_ULONG der_data_len;
    soft_rsa_ctx_t *rsa_ctx = session_p->verify.context;
    soft_object_t *key = rsa_ctx->key;
    CK_ULONG der_len;
    CK_BYTE_PTR der_prefix;

    if (Final) {
        rv = soft_digest_final(session_p, hash, &hash_len);
    } else {
        rv = soft_digest(session_p, pData, ulDataLen, hash, &hash_len);
    }

    if (rv != CKR_OK) {
        /* free the verification key */
        soft_cleanup_object(key);
        free(key);
        goto clean_exit;
    }

    /*
     * Prepare the DER encoding of the DigestInfo value as follows:
     * MD5:     MD5_DER_PREFIX || H
     * SHA-1:   SHA1_DER_PREFIX || H
     * SHA2:    SHA2_DER_PREFIX || H
     *
     * See rsa_impl.c for more details.
     */
    switch (session_p->digest.mech.mechanism) {
    case CKM_MD5:
        (void) memcpy(der_data, MD5_DER_PREFIX, MD5_DER_PREFIX_Len);
        (void) memcpy(der_data + MD5_DER_PREFIX_Len, hash, hash_len);
        der_data_len = MD5_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA_1:
        der_len = get_rsa_sha1_prefix(&(session_p->digest.mech),
            &der_prefix);
        (void) memcpy(der_data, der_prefix, der_len);
        (void) memcpy(der_data + der_len, hash, hash_len);
        der_data_len = der_len + hash_len;
        break;
    case CKM_SHA224:
        (void) memcpy(der_data, SHA224_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA256:
        (void) memcpy(der_data, SHA256_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA384:
        (void) memcpy(der_data, SHA384_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    case CKM_SHA512:
        (void) memcpy(der_data, SHA512_DER_PREFIX,
            SHA2_DER_PREFIX_Len);
        (void) memcpy(der_data + SHA2_DER_PREFIX_Len, hash, hash_len);
        der_data_len = SHA2_DER_PREFIX_Len + hash_len;
        break;
    }

    /*
     * Now, we are ready to verify the DER_ENCODED data using signature.
     * soft_rsa_verify_common() will free the verification key.
     */
    rv = soft_rsa_verify_common(session_p, der_data, der_data_len,
        pSigned, ulSignedLen, mechanism);

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    /* soft_digest_common() has freed the digest context */
    session_p->digest.flags = 0;
    (void) pthread_mutex_unlock(&session_p->session_mutex);

    return (rv);

}


CK_RV
soft_rsa_verify_recover(soft_session_t *session_p, CK_BYTE_PTR pSignature,
    CK_ULONG ulSignatureLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
{

    CK_RV rv = CKR_OK;
    soft_rsa_ctx_t *rsa_ctx = session_p->verify.context;
    CK_MECHANISM_TYPE mechanism = session_p->verify.mech.mechanism;
    soft_object_t *key = rsa_ctx->key;
    uchar_t modulus[MAX_KEY_ATTR_BUFLEN];
    uint32_t modulus_len = sizeof (modulus);
    CK_BYTE plain_data[MAX_RSA_KEYLENGTH_IN_BYTES];

    rv = soft_get_public_value(key, CKA_MODULUS, modulus, &modulus_len);
    if (rv != CKR_OK) {
        goto clean_exit;
    }

    if (ulSignatureLen != (CK_ULONG)modulus_len) {
        rv = CKR_SIGNATURE_LEN_RANGE;
        goto clean_exit;
    }

    /*
     * Perform RSA decryption with the signer's RSA public key
     * for verification process.
     */
    rv = soft_rsa_encrypt(key, pSignature, modulus_len, plain_data, 1);
    if (rv == CKR_OK) {
        switch (mechanism) {

        case CKM_RSA_PKCS:
        {
            /*
             * Strip off the encoded padding bytes in front of the
             * recovered data.
             */
            size_t data_len = modulus_len;

            rv = pkcs1_decode(PKCS1_VERIFY, plain_data, &data_len);
            if (rv != CKR_OK) {
                goto clean_exit;
            }

            /*
             * If application asks for the length of the output
             * buffer?
             */
            if (pData == NULL) {
                *pulDataLen = data_len;
                rv = CKR_OK;
                goto clean1;
            }

            /* Is the application-supplied buffer large enough? */
            if (*pulDataLen < (CK_ULONG)data_len) {
                *pulDataLen = data_len;
                rv = CKR_BUFFER_TOO_SMALL;
                goto clean1;
            }

            (void) memcpy(pData,
                &plain_data[modulus_len - data_len], data_len);
            *pulDataLen = data_len;

            break;
        }

        case CKM_RSA_X_509:
            /*
             * If application asks for the length of the output
             * buffer?
             */
            if (pData == NULL) {
                *pulDataLen = modulus_len;
                rv = CKR_OK;
                goto clean1;
            }

            /* Is the application-supplied buffer large enough? */
            if (*pulDataLen < (CK_ULONG)modulus_len) {
                *pulDataLen = modulus_len;
                rv = CKR_BUFFER_TOO_SMALL;
                goto clean1;
            }

            (void) memcpy(pData, plain_data, modulus_len);
            *pulDataLen = modulus_len;

            break;
        }
    }

clean_exit:
    (void) pthread_mutex_lock(&session_p->session_mutex);
    free(session_p->verify.context);
    session_p->verify.context = NULL;
    (void) pthread_mutex_unlock(&session_p->session_mutex);
    soft_cleanup_object(key);
    free(key);

clean1:
    return (rv);
}