From b5110de1b3a159dad898b0b0636bc7fb8f582faf Mon Sep 17 00:00:00 2001 From: Tianjie Xu Date: Tue, 23 Oct 2018 23:31:43 -0700 Subject: Add sanity check when loading public keys for OTA package For RSA keys, check if it has a 2048 bits modulus, and its public exponent is 3 or 65537. For EC keys, check if the field size is 256 bits for its curve. Bug: 116655889 Test: unit tests pass Change-Id: I5c00f4d2b61c98c434f0b49db232155d5d0770ec --- verifier.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'verifier.h') diff --git a/verifier.h b/verifier.h index b7924c71f..944823293 100644 --- a/verifier.h +++ b/verifier.h @@ -72,6 +72,12 @@ int verify_file(const unsigned char* addr, size_t length, const std::vector& certs); +// Checks that the RSA key has a modulus of 2048 bits long, and public exponent is 3 or 65537. +bool CheckRSAKey(const std::unique_ptr& rsa); + +// Checks that the field size of the curve for the EC key is 256 bits. +bool CheckECKey(const std::unique_ptr& ec_key); + // Parses a PEM-encoded x509 certificate from the given buffer and saves it into |cert|. Returns // false if there is a parsing failure or the signature's encryption algorithm is not supported. bool LoadCertificateFromBuffer(const std::vector& pem_content, Certificate* cert); -- cgit v1.2.3