crypto/internal/fips140/rsa: support separate MGF1 hash for EncryptOAEP

We might or might not want to expose it, but it makes the internal API
symmetrical, and lets us decide to do it in the future without changing
the FIPS module.

Updates #65716

Change-Id: Iea431a527ab17b9f00dee4da25761cedb2c2eba0
Reviewed-on: https://go-review.googlesource.com/c/go/+/630655
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>

diff --git a/src/crypto/internal/fips140/rsa/pkcs1v22.go b/src/crypto/internal/fips140/rsa/pkcs1v22.go
index 2e82317ffaaa4e1cf4ab6b7bd0d769ed5cb0902d..c7aa955bb4ffeb78785492876b537dbc41916838 100644 (file)
--- a/src/crypto/internal/fips140/rsa/pkcs1v22.go
+++ b/src/crypto/internal/fips140/rsa/pkcs1v22.go
@@ -374,7 +374,7 @@ func checkApprovedHash(hash fips140.Hash) {
 // EncryptOAEP encrypts the given message with RSAES-OAEP.
 //
 // In FIPS mode, random is ignored and can be nil.
-func EncryptOAEP(hash fips140.Hash, random io.Reader, pub *PublicKey, msg []byte, label []byte) ([]byte, error) {
+func EncryptOAEP(hash, mgfHash fips140.Hash, random io.Reader, pub *PublicKey, msg []byte, label []byte) ([]byte, error) {
        // Note that while we don't commit to deterministic execution with respect
        // to the random stream, we also don't apply MaybeReadByte, so per Hyrum's
        // Law it's probably relied upon by some. It's a tolerable promise because a
@@ -413,8 +413,8 @@ func EncryptOAEP(hash fips140.Hash, random io.Reader, pub *PublicKey, msg []byte
                }
        }
 
-       mgf1XOR(db, hash, seed)
-       mgf1XOR(seed, hash, db)
+       mgf1XOR(db, mgfHash, seed)
+       mgf1XOR(seed, mgfHash, db)
 
        return encrypt(pub, em)
 }

diff --git a/src/crypto/rsa/fips.go b/src/crypto/rsa/fips.go
index a08de0e75e1c38c69da6f76592e323895422e17e..309ed273ec5aec376a8096ed8c5a2bc488123c2a 100644 (file)
--- a/src/crypto/rsa/fips.go
+++ b/src/crypto/rsa/fips.go
@@ -172,7 +172,7 @@ func EncryptOAEP(hash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, l
        if err != nil {
                return nil, err
        }
-       return fipsError2(rsa.EncryptOAEP(hash, random, k, msg, label))
+       return fipsError2(rsa.EncryptOAEP(hash, hash, random, k, msg, label))
 }
 
 // DecryptOAEP decrypts ciphertext using RSA-OAEP.