Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev

Merging changes for the v.6.5.1.202602 release

1 files changed, 59 insertions, 14 deletions

diff --git a/nx_secure/src/nx_secure_tls_process_certificate_verify.c b/nx_secure/src/nx_secure_tls_process_certificate_verify.c
index 0d5bcd0d..e817767f 100644
--- a/nx_secure/src/nx_secure_tls_process_certificate_verify.c
+++ b/nx_secure/src/nx_secure_tls_process_certificate_verify.c
@@ -26,10 +26,14 @@
 #ifdef NX_SECURE_ENABLE_DTLS
 #include "nx_secure_dtls.h"
 #endif /* NX_SECURE_ENABLE_DTLS */
+#include "nx_crypto_rsa.h"
 
 #ifndef NX_SECURE_DISABLE_X509
-static UCHAR handshake_hash[64 + 34 + 32]; /* We concatenate MD5 and SHA-1 hashes into this buffer, OR SHA-256. */
+static UCHAR handshake_hash[64 + 34 + 64]; /* We concatenate MD5 and SHA-1 hashes into this buffer, OR SHA-256/384/512. */
 static UCHAR _nx_secure_decrypted_signature[600];
+#if (NX_SECURE_TLS_TLS_1_3_ENABLED)
+static UCHAR _nx_secure_pss_scratch[600]; /* PSS verify: db[<=511 B] + h_prime[<=64 B] for RSA-4096+SHA-512 */
+#endif
 
 #if (NX_SECURE_TLS_TLS_1_2_ENABLED)
 static const UCHAR _NX_SECURE_OID_SHA256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
@@ -158,7 +162,7 @@ NX_SECURE_EC_PUBLIC_KEY              *ec_pubkey;
 #if (NX_SECURE_TLS_TLS_1_3_ENABLED)
     if (tls_session -> nx_secure_tls_1_3)
     {
-        /* TLS1.3 uses RSASSA-PSS instead of RSASSA-PKCS. RSASSA-PSS is not supported now. */
+        /* Select crypto methods based on the wire signature algorithm code. */
         switch ((UINT)((packet_buffer[0] << 8) + packet_buffer[1]))
         {
         case NX_SECURE_TLS_SIGNATURE_ECDSA_SHA256:
@@ -170,6 +174,15 @@ NX_SECURE_EC_PUBLIC_KEY              *ec_pubkey;
         case NX_SECURE_TLS_SIGNATURE_ECDSA_SHA512:
             signature_algorithm = NX_SECURE_TLS_X509_TYPE_ECDSA_SHA_512;
             break;
+        case 0x0804u: /* rsa_pss_rsae_sha256 */
+            signature_algorithm = NX_SECURE_TLS_X509_TYPE_RSA_SHA_256;
+            break;
+        case 0x0805u: /* rsa_pss_rsae_sha384 */
+            signature_algorithm = NX_SECURE_TLS_X509_TYPE_RSA_SHA_384;
+            break;
+        case 0x0806u: /* rsa_pss_rsae_sha512 */
+            signature_algorithm = NX_SECURE_TLS_X509_TYPE_RSA_SHA_512;
+            break;
         default:
             return(NX_SECURE_TLS_UNSUPPORTED_CERT_SIGN_ALG);
         }
@@ -222,19 +235,22 @@ NX_SECURE_EC_PUBLIC_KEY              *ec_pubkey;
              NX_SECURE_MEMCPY(&handshake_hash[64], client_context, 34); /* Use case of memcpy is verified. */
          }
 
-         /* Copy in transcript hash. */
-         NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); /* Use case of memcpy is verified. */
-
-         handshake_hash_length = 130;
-
-
-         /* Generate a hash of the data we just produced. */
-         /* Use SHA-256 for now... */
+         /* Determine hash method and transcript hash length before copying.
+            hash_method drives the transcript hash size: 32 (SHA-256), 48 (SHA-384), 64 (SHA-512). */
          hash_method = crypto_methods -> nx_secure_x509_hash_method;
 
          metadata = tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch;
          metadata_size = tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch_size;
 
+         {
+         UINT transcript_hash_len = (UINT)(hash_method -> nx_crypto_ICV_size_in_bits >> 3);
+
+         /* Copy in transcript hash — length depends on negotiated hash algorithm. */
+         NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, transcript_hash_len); /* Use case of memcpy is verified. */
+
+         handshake_hash_length = 64u + 34u + transcript_hash_len;
+         }
+
 
          /* Hash the data using the chosen hash method. */
          if (hash_method -> nx_crypto_init)
@@ -497,11 +513,16 @@ NX_SECURE_EC_PUBLIC_KEY              *ec_pubkey;
         if (tls_session -> nx_secure_tls_protocol_version == NX_SECURE_TLS_VERSION_TLS_1_2)
 #endif /* NX_SECURE_ENABLE_DTLS */
         {
-            /* Check the signature method. */
-            if (packet_buffer[0] != NX_SECURE_TLS_HASH_ALGORITHM_SHA256 ||
-                packet_buffer[1] != NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA)
+            /* Check the signature method (skipped for TLS 1.3: already validated above). */
+#if (NX_SECURE_TLS_TLS_1_3_ENABLED)
+            if (!tls_session -> nx_secure_tls_1_3)
+#endif
             {
-                return(NX_SECURE_TLS_UNKNOWN_CERT_SIG_ALGORITHM);
+                if (packet_buffer[0] != NX_SECURE_TLS_HASH_ALGORITHM_SHA256 ||
+                    packet_buffer[1] != NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA)
+                {
+                    return(NX_SECURE_TLS_UNKNOWN_CERT_SIG_ALGORITHM);
+                }
             }
 
             /* Get the length of the encrypted signature data. */
@@ -612,6 +633,30 @@ NX_SECURE_EC_PUBLIC_KEY              *ec_pubkey;
             }
         }
 
+#if (NX_SECURE_TLS_TLS_1_3_ENABLED)
+        if (tls_session -> nx_secure_tls_1_3)
+        {
+            /* RSA-PSS verification for TLS 1.3 (RFC 8017 §9.1.2, RFC 8446 §4.4.3). */
+            UINT hash_len = (UINT)(hash_method -> nx_crypto_ICV_size_in_bits >> 3);
+            UINT em_bits  = (data_size << 3) - 1u; /* emBits = modBits - 1 */
+
+            status = _nx_crypto_rsa_pss_verify(
+                handshake_hash, hash_len,
+                _nx_secure_decrypted_signature, em_bits,
+                hash_method,
+                tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch,
+                tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch_size,
+                _nx_secure_pss_scratch, sizeof(_nx_secure_pss_scratch));
+
+#ifdef NX_SECURE_KEY_CLEAR
+            NX_SECURE_MEMSET(handshake_hash, 0, sizeof(handshake_hash));
+            NX_SECURE_MEMSET(_nx_secure_decrypted_signature, 0, sizeof(_nx_secure_decrypted_signature));
+            NX_SECURE_MEMSET(_nx_secure_pss_scratch, 0, sizeof(_nx_secure_pss_scratch));
+#endif /* NX_SECURE_KEY_CLEAR */
+            return((status == NX_CRYPTO_SUCCESS) ? NX_SUCCESS : (UINT)NX_SECURE_TLS_CERTIFICATE_VERIFY_FAILURE);
+        }
+#endif /* NX_SECURE_TLS_TLS_1_3_ENABLED */
+
         /* Check PKCS-1 Signature padding. The scheme is to start with the block type (0x00, 0x01 for signing)
            then pad with 0xFF bytes (for signing) followed with a single 0 byte right before the payload,
            which comes at the end of the RSA block. */