1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
28 #include <stddef.h>
29 #include <stdint.h>
31 #ifdef __cplusplus
32 extern "C" {
33 #endif
36 *
37 * # RSA
38 *
39 * This file documents the RSA implementations provided with BearSSL.
40 * Note that the SSL engine accesses these implementations through a
41 * configurable API, so it is possible to, for instance, run a SSL
42 * server which uses a RSA engine which is not based on this code.
43 *
44 * ## Key Elements
45 *
46 * RSA public and private keys consist in lists of big integers. All
47 * such integers are represented with big-endian unsigned notation:
48 * first byte is the most significant, and the value is positive (so
49 * there is no dedicated "sign bit"). Public and private key structures
50 * thus contain, for each such integer, a pointer to the first value byte
51 * (`unsigned char *`), and a length (`size_t`) which is the number of
52 * relevant bytes. As a general rule, minimal-length encoding is not
53 * enforced: values may have extra leading bytes of value 0.
54 *
55 * RSA public keys consist in two integers:
56 *
57 * - the modulus (`n`);
58 * - the public exponent (`e`).
59 *
60 * RSA private keys, as defined in
61 * [PKCS#1](https://tools.ietf.org/html/rfc3447), contain eight integers:
62 *
63 * - the modulus (`n`);
64 * - the public exponent (`e`);
65 * - the private exponent (`d`);
66 * - the first prime factor (`p`);
67 * - the second prime factor (`q`);
68 * - the first reduced exponent (`dp`, which is `d` modulo `p-1`);
69 * - the second reduced exponent (`dq`, which is `d` modulo `q-1`);
70 * - the CRT coefficient (`iq`, the inverse of `q` modulo `p`).
71 *
72 * However, the implementations defined in BearSSL use only five of
73 * these integers: `p`, `q`, `dp`, `dq` and `iq`.
74 *
75 * ## Security Features and Limitations
76 *
77 * The implementations contained in BearSSL have the following limitations
78 * and features:
79 *
80 * - They are constant-time. This means that the execution time and
81 * memory access pattern may depend on the _lengths_ of the private
82 * key components, but not on their value, nor on the value of
83 * the operand. Note that this property is not achieved through
84 * random masking, but "true" constant-time code.
85 *
86 * - They support only private keys with two prime factors. RSA private
87 * key with three or more prime factors are nominally supported, but
88 * rarely used; they may offer faster operations, at the expense of
89 * more code and potentially a reduction in security if there are
90 * "too many" prime factors.
91 *
92 * - The public exponent may have arbitrary length. Of course, it is
93 * a good idea to keep public exponents small, so that public key
94 * operations are fast; but, contrary to some widely deployed
95 * implementations, BearSSL has no problem with public exponent
96 * longer than 32 bits.
97 *
98 * - The two prime factors of the modulus need not have the same length
99 * (but severely imbalanced factor lengths might reduce security).
100 * Similarly, there is no requirement that the first factor (`p`)
101 * be greater than the second factor (`q`).
102 *
103 * - Prime factors and modulus must be smaller than a compile-time limit.
104 * This is made necessary by the use of fixed-size stack buffers, and
105 * the limit has been adjusted to keep stack usage under 2 kB for the
106 * RSA operations. Currently, the maximum modulus size is 4096 bits,
107 * and the maximum prime factor size is 2080 bits.
108 *
109 * - The RSA functions themselves do not enforce lower size limits,
110 * except that which is absolutely necessary for the operation to
111 * mathematically make sense (e.g. a PKCS#1 v1.5 signature with
112 * SHA-1 requires a modulus of at least 361 bits). It is up to users
113 * of this code to enforce size limitations when appropriate (e.g.
114 * the X.509 validation engine, by default, rejects RSA keys of
115 * less than 1017 bits).
116 *
117 * - Within the size constraints expressed above, arbitrary bit lengths
118 * are supported. There is no requirement that prime factors or
119 * modulus have a size multiple of 8 or 16.
120 *
121 * - When verifying PKCS#1 v1.5 signatures, both variants of the hash
122 * function identifying header (with and without the ASN.1 NULL) are
123 * supported. When producing such signatures, the variant with the
124 * ASN.1 NULL is used.
125 *
126 * ## Implementations
127 *
128 * Three RSA implementations are included:
129 *
130 * - The **i32** implementation internally represents big integers
131 * as arrays of 32-bit integers. It is perfunctory and portable,
132 * but not very efficient.
133 *
134 * - The **i31** implementation uses 32-bit integers, each containing
135 * 31 bits worth of integer data. The i31 implementation is somewhat
136 * faster than the i32 implementation (the reduced integer size makes
137 * carry propagation easier) for a similar code footprint, but uses
138 * very slightly larger stack buffers (about 4% bigger).
139 *
140 * - The **i62** implementation is similar to the i31 implementation,
141 * except that it internally leverages the 64x64->128 multiplication
142 * opcode. This implementation is available only on architectures
143 * where such an opcode exists. It is much faster than i31.
144 *
145 * - The **i15** implementation uses 16-bit integers, each containing
146 * 15 bits worth of integer data. Multiplication results fit on
147 * 32 bits, so this won't use the "widening" multiplication routine
148 * on ARM Cortex M0/M0+, for much better performance and constant-time
149 * execution.
150 */
152 /**
153 * \brief RSA public key.
154 *
155 * The structure references the modulus and the public exponent. Both
156 * integers use unsigned big-endian representation; extra leading bytes
157 * of value 0 are allowed.
158 */
159 typedef struct {
160 /** \brief Modulus. */
161 unsigned char *n;
162 /** \brief Modulus length (in bytes). */
163 size_t nlen;
164 /** \brief Public exponent. */
165 unsigned char *e;
166 /** \brief Public exponent length (in bytes). */
167 size_t elen;
168 } br_rsa_public_key;
170 /**
171 * \brief RSA private key.
172 *
173 * The structure references the primvate factors, reduced private
174 * exponents, and CRT coefficient. It also contains the bit length of
175 * the modulus. The big integers use unsigned big-endian representation;
176 * extra leading bytes of value 0 are allowed. However, the modulus bit
177 * length (`n_bitlen`) MUST be exact.
178 */
179 typedef struct {
180 /** \brief Modulus bit length (in bits, exact value). */
181 uint32_t n_bitlen;
182 /** \brief First prime factor. */
183 unsigned char *p;
184 /** \brief First prime factor length (in bytes). */
185 size_t plen;
186 /** \brief Second prime factor. */
187 unsigned char *q;
188 /** \brief Second prime factor length (in bytes). */
189 size_t qlen;
190 /** \brief First reduced private exponent. */
191 unsigned char *dp;
192 /** \brief First reduced private exponent length (in bytes). */
193 size_t dplen;
194 /** \brief Second reduced private exponent. */
195 unsigned char *dq;
196 /** \brief Second reduced private exponent length (in bytes). */
197 size_t dqlen;
198 /** \brief CRT coefficient. */
199 unsigned char *iq;
200 /** \brief CRT coefficient length (in bytes). */
201 size_t iqlen;
202 } br_rsa_private_key;
204 /**
205 * \brief Type for a RSA public key engine.
206 *
207 * The public key engine performs the modular exponentiation of the
208 * provided value with the public exponent. The value is modified in
209 * place.
210 *
211 * The value length (`xlen`) is verified to have _exactly_ the same
212 * length as the modulus (actual modulus length, without extra leading
213 * zeros in the modulus representation in memory). If the length does
214 * not match, then this function returns 0 and `x[]` is unmodified.
215 *
216 * It `xlen` is correct, then `x[]` is modified. Returned value is 1
217 * on success, 0 on error. Error conditions include an oversized `x[]`
218 * (the array has the same length as the modulus, but the numerical value
219 * is not lower than the modulus) and an invalid modulus (e.g. an even
220 * integer). If an error is reported, then the new contents of `x[]` are
221 * unspecified.
222 *
223 * \param x operand to exponentiate.
224 * \param xlen length of the operand (in bytes).
225 * \param pk RSA public key.
226 * \return 1 on success, 0 on error.
227 */
228 typedef uint32_t (*br_rsa_public)(unsigned char *x, size_t xlen,
229 const br_rsa_public_key *pk);
231 /**
232 * \brief Type for a RSA signature verification engine (PKCS#1 v1.5).
233 *
234 * Parameters are:
235 *
236 * - The signature itself. The provided array is NOT modified.
237 *
238 * - The encoded OID for the hash function. The provided array must begin
239 * with a single byte that contains the length of the OID value (in
240 * bytes), followed by exactly that many bytes. This parameter may
241 * also be `NULL`, in which case the raw hash value should be used
242 * with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
243 * to TLS-1.1, with a 36-byte hash value).
244 *
245 * - The hash output length, in bytes.
246 *
247 * - The public key.
248 *
249 * - An output buffer for the hash value. The caller must still compare
250 * it with the hash of the data over which the signature is computed.
251 *
252 * **Constraints:**
253 *
254 * - Hash length MUST be no more than 64 bytes.
255 *
256 * - OID value length MUST be no more than 32 bytes (i.e. `hash_oid`
257 * must have a value in the 0..32 range, inclusive).
258 *
259 * This function verifies that the signature length (`xlen`) matches the
260 * modulus length (this function returns 0 on mismatch). If the modulus
261 * size exceeds the maximum supported RSA size, then the function also
262 * returns 0.
263 *
264 * Returned value is 1 on success, 0 on error.
265 *
266 * Implementations of this type need not be constant-time.
267 *
268 * \param x signature buffer.
269 * \param xlen signature length (in bytes).
270 * \param hash_oid encoded hash algorithm OID (or `NULL`).
271 * \param hash_len expected hash value length (in bytes).
272 * \param pk RSA public key.
273 * \param hash_out output buffer for the hash value.
274 * \return 1 on success, 0 on error.
275 */
276 typedef uint32_t (*br_rsa_pkcs1_vrfy)(const unsigned char *x, size_t xlen,
277 const unsigned char *hash_oid, size_t hash_len,
278 const br_rsa_public_key *pk, unsigned char *hash_out);
280 /**
281 * \brief Type for a RSA private key engine.
282 *
283 * The `x[]` buffer is modified in place, and its length is inferred from
284 * the modulus length (`x[]` is assumed to have a length of
285 * `(sk->n_bitlen+7)/8` bytes).
286 *
287 * Returned value is 1 on success, 0 on error.
288 *
289 * \param x operand to exponentiate.
290 * \param sk RSA private key.
291 * \return 1 on success, 0 on error.
292 */
293 typedef uint32_t (*br_rsa_private)(unsigned char *x,
294 const br_rsa_private_key *sk);
296 /**
297 * \brief Type for a RSA signature generation engine (PKCS#1 v1.5).
298 *
299 * Parameters are:
300 *
301 * - The encoded OID for the hash function. The provided array must begin
302 * with a single byte that contains the length of the OID value (in
303 * bytes), followed by exactly that many bytes. This parameter may
304 * also be `NULL`, in which case the raw hash value should be used
305 * with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
306 * to TLS-1.1, with a 36-byte hash value).
307 *
308 * - The hash value computes over the data to sign (its length is
309 * expressed in bytes).
310 *
311 * - The RSA private key.
312 *
313 * - The output buffer, that receives the signature.
314 *
315 * Returned value is 1 on success, 0 on error. Error conditions include
316 * a too small modulus for the provided hash OID and value, or some
317 * invalid key parameters. The signature length is exactly
318 * `(sk->n_bitlen+7)/8` bytes.
319 *
320 * This function is expected to be constant-time with regards to the
321 * private key bytes (lengths of the modulus and the individual factors
322 * may leak, though) and to the hashed data.
323 *
324 * \param hash_oid encoded hash algorithm OID (or `NULL`).
325 * \param hash hash value.
326 * \param hash_len hash value length (in bytes).
327 * \param sk RSA private key.
328 * \param x output buffer for the signature value.
329 * \return 1 on success, 0 on error.
330 */
331 typedef uint32_t (*br_rsa_pkcs1_sign)(const unsigned char *hash_oid,
332 const unsigned char *hash, size_t hash_len,
333 const br_rsa_private_key *sk, unsigned char *x);
335 /**
336 * \brief Encoded OID for SHA-1 (in RSA PKCS#1 signatures).
337 */
338 #define BR_HASH_OID_SHA1 \
339 ((const unsigned char *)"\x05\x2B\x0E\x03\x02\x1A")
341 /**
342 * \brief Encoded OID for SHA-224 (in RSA PKCS#1 signatures).
343 */
344 #define BR_HASH_OID_SHA224 \
345 ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x04")
347 /**
348 * \brief Encoded OID for SHA-256 (in RSA PKCS#1 signatures).
349 */
350 #define BR_HASH_OID_SHA256 \
351 ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01")
353 /**
354 * \brief Encoded OID for SHA-384 (in RSA PKCS#1 signatures).
355 */
356 #define BR_HASH_OID_SHA384 \
357 ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x02")
359 /**
360 * \brief Encoded OID for SHA-512 (in RSA PKCS#1 signatures).
361 */
362 #define BR_HASH_OID_SHA512 \
363 ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x03")
365 /*
366 * RSA "i32" engine. Integers are internally represented as arrays of
367 * 32-bit integers, and the core multiplication primitive is the
368 * 32x32->64 multiplication.
369 */
371 /**
372 * \brief RSA public key engine "i32".
373 *
374 * \see br_rsa_public
375 *
376 * \param x operand to exponentiate.
377 * \param xlen length of the operand (in bytes).
378 * \param pk RSA public key.
379 * \return 1 on success, 0 on error.
380 */
381 uint32_t br_rsa_i32_public(unsigned char *x, size_t xlen,
382 const br_rsa_public_key *pk);
384 /**
385 * \brief RSA signature verification engine "i32".
386 *
387 * \see br_rsa_pkcs1_vrfy
388 *
389 * \param x signature buffer.
390 * \param xlen signature length (in bytes).
391 * \param hash_oid encoded hash algorithm OID (or `NULL`).
392 * \param hash_len expected hash value length (in bytes).
393 * \param pk RSA public key.
394 * \param hash_out output buffer for the hash value.
395 * \return 1 on success, 0 on error.
396 */
397 uint32_t br_rsa_i32_pkcs1_vrfy(const unsigned char *x, size_t xlen,
398 const unsigned char *hash_oid, size_t hash_len,
399 const br_rsa_public_key *pk, unsigned char *hash_out);
401 /**
402 * \brief RSA private key engine "i32".
403 *
404 * \see br_rsa_private
405 *
406 * \param x operand to exponentiate.
407 * \param sk RSA private key.
408 * \return 1 on success, 0 on error.
409 */
410 uint32_t br_rsa_i32_private(unsigned char *x,
411 const br_rsa_private_key *sk);
413 /**
414 * \brief RSA signature generation engine "i32".
415 *
416 * \see br_rsa_pkcs1_sign
417 *
418 * \param hash_oid encoded hash algorithm OID (or `NULL`).
419 * \param hash hash value.
420 * \param hash_len hash value length (in bytes).
421 * \param sk RSA private key.
422 * \param x output buffer for the hash value.
423 * \return 1 on success, 0 on error.
424 */
425 uint32_t br_rsa_i32_pkcs1_sign(const unsigned char *hash_oid,
426 const unsigned char *hash, size_t hash_len,
427 const br_rsa_private_key *sk, unsigned char *x);
429 /*
430 * RSA "i31" engine. Similar to i32, but only 31 bits are used per 32-bit
431 * word. This uses slightly more stack space (about 4% more) and code
432 * space, but it quite faster.
433 */
435 /**
436 * \brief RSA public key engine "i31".
437 *
438 * \see br_rsa_public
439 *
440 * \param x operand to exponentiate.
441 * \param xlen length of the operand (in bytes).
442 * \param pk RSA public key.
443 * \return 1 on success, 0 on error.
444 */
445 uint32_t br_rsa_i31_public(unsigned char *x, size_t xlen,
446 const br_rsa_public_key *pk);
448 /**
449 * \brief RSA signature verification engine "i31".
450 *
451 * \see br_rsa_pkcs1_vrfy
452 *
453 * \param x signature buffer.
454 * \param xlen signature length (in bytes).
455 * \param hash_oid encoded hash algorithm OID (or `NULL`).
456 * \param hash_len expected hash value length (in bytes).
457 * \param pk RSA public key.
458 * \param hash_out output buffer for the hash value.
459 * \return 1 on success, 0 on error.
460 */
461 uint32_t br_rsa_i31_pkcs1_vrfy(const unsigned char *x, size_t xlen,
462 const unsigned char *hash_oid, size_t hash_len,
463 const br_rsa_public_key *pk, unsigned char *hash_out);
465 /**
466 * \brief RSA private key engine "i31".
467 *
468 * \see br_rsa_private
469 *
470 * \param x operand to exponentiate.
471 * \param sk RSA private key.
472 * \return 1 on success, 0 on error.
473 */
474 uint32_t br_rsa_i31_private(unsigned char *x,
475 const br_rsa_private_key *sk);
477 /**
478 * \brief RSA signature generation engine "i31".
479 *
480 * \see br_rsa_pkcs1_sign
481 *
482 * \param hash_oid encoded hash algorithm OID (or `NULL`).
483 * \param hash hash value.
484 * \param hash_len hash value length (in bytes).
485 * \param sk RSA private key.
486 * \param x output buffer for the hash value.
487 * \return 1 on success, 0 on error.
488 */
489 uint32_t br_rsa_i31_pkcs1_sign(const unsigned char *hash_oid,
490 const unsigned char *hash, size_t hash_len,
491 const br_rsa_private_key *sk, unsigned char *x);
493 /*
494 * RSA "i62" engine. Similar to i31, but internal multiplication use
495 * 64x64->128 multiplications. This is available only on architecture
496 * that offer such an opcode.
497 */
499 /**
500 * \brief RSA public key engine "i62".
501 *
502 * This function is defined only on architecture that offer a 64x64->128
503 * opcode. Use `br_rsa_i62_public_get()` to dynamically obtain a pointer
504 * to that functiom.
505 *
506 * \see br_rsa_public
507 *
508 * \param x operand to exponentiate.
509 * \param xlen length of the operand (in bytes).
510 * \param pk RSA public key.
511 * \return 1 on success, 0 on error.
512 */
513 uint32_t br_rsa_i62_public(unsigned char *x, size_t xlen,
514 const br_rsa_public_key *pk);
516 /**
517 * \brief RSA signature verification engine "i62".
518 *
519 * This function is defined only on architecture that offer a 64x64->128
520 * opcode. Use `br_rsa_i62_pkcs1_vrfy_get()` to dynamically obtain a pointer
521 * to that functiom.
522 *
523 * \see br_rsa_pkcs1_vrfy
524 *
525 * \param x signature buffer.
526 * \param xlen signature length (in bytes).
527 * \param hash_oid encoded hash algorithm OID (or `NULL`).
528 * \param hash_len expected hash value length (in bytes).
529 * \param pk RSA public key.
530 * \param hash_out output buffer for the hash value.
531 * \return 1 on success, 0 on error.
532 */
533 uint32_t br_rsa_i62_pkcs1_vrfy(const unsigned char *x, size_t xlen,
534 const unsigned char *hash_oid, size_t hash_len,
535 const br_rsa_public_key *pk, unsigned char *hash_out);
537 /**
538 * \brief RSA private key engine "i62".
539 *
540 * This function is defined only on architecture that offer a 64x64->128
541 * opcode. Use `br_rsa_i62_private_get()` to dynamically obtain a pointer
542 * to that functiom.
543 *
544 * \see br_rsa_private
545 *
546 * \param x operand to exponentiate.
547 * \param sk RSA private key.
548 * \return 1 on success, 0 on error.
549 */
550 uint32_t br_rsa_i62_private(unsigned char *x,
551 const br_rsa_private_key *sk);
553 /**
554 * \brief RSA signature generation engine "i62".
555 *
556 * This function is defined only on architecture that offer a 64x64->128
557 * opcode. Use `br_rsa_i62_pkcs1_sign_get()` to dynamically obtain a pointer
558 * to that functiom.
559 *
560 * \see br_rsa_pkcs1_sign
561 *
562 * \param hash_oid encoded hash algorithm OID (or `NULL`).
563 * \param hash hash value.
564 * \param hash_len hash value length (in bytes).
565 * \param sk RSA private key.
566 * \param x output buffer for the hash value.
567 * \return 1 on success, 0 on error.
568 */
569 uint32_t br_rsa_i62_pkcs1_sign(const unsigned char *hash_oid,
570 const unsigned char *hash, size_t hash_len,
571 const br_rsa_private_key *sk, unsigned char *x);
573 /**
574 * \brief Get the RSA "i62" implementation (public key operations),
575 * if available.
576 *
577 * \return the implementation, or 0.
578 */
579 br_rsa_public br_rsa_i62_public_get(void);
581 /**
582 * \brief Get the RSA "i62" implementation (PKCS#1 signature verification),
583 * if available.
584 *
585 * \return the implementation, or 0.
586 */
587 br_rsa_pkcs1_vrfy br_rsa_i62_pkcs1_vrfy_get(void);
589 /**
590 * \brief Get the RSA "i62" implementation (private key operations),
591 * if available.
592 *
593 * \return the implementation, or 0.
594 */
595 br_rsa_private br_rsa_i62_private_get(void);
597 /**
598 * \brief Get the RSA "i62" implementation (PKCS#1 signature generation),
599 * if available.
600 *
601 * \return the implementation, or 0.
602 */
603 br_rsa_pkcs1_sign br_rsa_i62_pkcs1_sign_get(void);
605 /*
606 * RSA "i15" engine. Integers are represented as 15-bit integers, so
607 * the code uses only 32-bit multiplication (no 64-bit result), which
608 * is vastly faster (and constant-time) on the ARM Cortex M0/M0+.
609 */
611 /**
612 * \brief RSA public key engine "i15".
613 *
614 * \see br_rsa_public
615 *
616 * \param x operand to exponentiate.
617 * \param xlen length of the operand (in bytes).
618 * \param pk RSA public key.
619 * \return 1 on success, 0 on error.
620 */
621 uint32_t br_rsa_i15_public(unsigned char *x, size_t xlen,
622 const br_rsa_public_key *pk);
624 /**
625 * \brief RSA signature verification engine "i15".
626 *
627 * \see br_rsa_pkcs1_vrfy
628 *
629 * \param x signature buffer.
630 * \param xlen signature length (in bytes).
631 * \param hash_oid encoded hash algorithm OID (or `NULL`).
632 * \param hash_len expected hash value length (in bytes).
633 * \param pk RSA public key.
634 * \param hash_out output buffer for the hash value.
635 * \return 1 on success, 0 on error.
636 */
637 uint32_t br_rsa_i15_pkcs1_vrfy(const unsigned char *x, size_t xlen,
638 const unsigned char *hash_oid, size_t hash_len,
639 const br_rsa_public_key *pk, unsigned char *hash_out);
641 /**
642 * \brief RSA private key engine "i15".
643 *
644 * \see br_rsa_private
645 *
646 * \param x operand to exponentiate.
647 * \param sk RSA private key.
648 * \return 1 on success, 0 on error.
649 */
650 uint32_t br_rsa_i15_private(unsigned char *x,
651 const br_rsa_private_key *sk);
653 /**
654 * \brief RSA signature generation engine "i15".
655 *
656 * \see br_rsa_pkcs1_sign
657 *
658 * \param hash_oid encoded hash algorithm OID (or `NULL`).
659 * \param hash hash value.
660 * \param hash_len hash value length (in bytes).
661 * \param sk RSA private key.
662 * \param x output buffer for the hash value.
663 * \return 1 on success, 0 on error.
664 */
665 uint32_t br_rsa_i15_pkcs1_sign(const unsigned char *hash_oid,
666 const unsigned char *hash, size_t hash_len,
667 const br_rsa_private_key *sk, unsigned char *x);
669 /**
670 * \brief Get "default" RSA implementation (public-key operations).
671 *
672 * This returns the preferred implementation of RSA (public-key operations)
673 * on the current system.
674 *
675 * \return the default implementation.
676 */
677 br_rsa_public br_rsa_public_get_default(void);
679 /**
680 * \brief Get "default" RSA implementation (private-key operations).
681 *
682 * This returns the preferred implementation of RSA (private-key operations)
683 * on the current system.
684 *
685 * \return the default implementation.
686 */
687 br_rsa_private br_rsa_private_get_default(void);
689 /**
690 * \brief Get "default" RSA implementation (PKCS#1 signature verification).
691 *
692 * This returns the preferred implementation of RSA (signature verification)
693 * on the current system.
694 *
695 * \return the default implementation.
696 */
697 br_rsa_pkcs1_vrfy br_rsa_pkcs1_vrfy_get_default(void);
699 /**
700 * \brief Get "default" RSA implementation (PKCS#1 signature generation).
701 *
702 * This returns the preferred implementation of RSA (signature generation)
703 * on the current system.
704 *
705 * \return the default implementation.
706 */
707 br_rsa_pkcs1_sign br_rsa_pkcs1_sign_get_default(void);
709 /**
710 * \brief RSA decryption helper, for SSL/TLS.
711 *
712 * This function performs the RSA decryption for a RSA-based key exchange
713 * in a SSL/TLS server. The provided RSA engine is used. The `data`
714 * parameter points to the value to decrypt, of length `len` bytes. On
715 * success, the 48-byte pre-master secret is copied into `data`, starting
716 * at the first byte of that buffer; on error, the contents of `data`
717 * become indeterminate.
718 *
719 * This function first checks that the provided value length (`len`) is
720 * not lower than 59 bytes, and matches the RSA modulus length; if neither
721 * of this property is met, then this function returns 0 and the buffer
722 * is unmodified.
723 *
724 * Otherwise, decryption and then padding verification are performed, both
725 * in constant-time. A decryption error, or a bad padding, or an
726 * incorrect decrypted value length are reported with a returned value of
727 * 0; on success, 1 is returned. The caller (SSL server engine) is supposed
728 * to proceed with a random pre-master secret in case of error.
729 *
730 * \param core RSA private key engine.
731 * \param sk RSA private key.
732 * \param data input/output buffer.
733 * \param len length (in bytes) of the data to decrypt.
734 * \return 1 on success, 0 on error.
735 */
736 uint32_t br_rsa_ssl_decrypt(br_rsa_private core, const br_rsa_private_key *sk,
737 unsigned char *data, size_t len);
739 #ifdef __cplusplus
740 }
741 #endif
743 #endif
{"ft_lang_label":"__label__en","ft_lang_prob":0.6663656,"math_prob":0.8599572,"size":24837,"snap":"2022-27-2022-33","text_gpt3_token_len":6448,"char_repetition_ratio":0.18088834,"word_repetition_ratio":0.1740266,"special_character_ratio":0.33619198,"punctuation_ratio":0.121499546,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.9527264,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2022-06-26T16:38:03Z\",\"WARC-Record-ID\":\"<urn:uuid:021f087c-085a-4484-a874-94b375301e71>\",\"Content-Length\":\"212309\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:5ce5bb74-0db8-4f38-b164-c33cfb103237>\",\"WARC-Concurrent-To\":\"<urn:uuid:3c425b9b-9362-4eec-a093-be7cd541e05e>\",\"WARC-IP-Address\":\"158.69.204.153\",\"WARC-Target-URI\":\"https://bearssl.org/gitweb/?p=BearSSL;a=blob;f=inc/bearssl_rsa.h;h=3d5c26a3222602ae658d168cfcc0001e4b958f34;hb=5414fd525e903fe65e372735f106dcdc19109aad\",\"WARC-Payload-Digest\":\"sha1:Q7ZEY7IP4JIGTKC7IQJ5IMZMUNH4E3PX\",\"WARC-Block-Digest\":\"sha1:ECCB2TXQEJH2U3PEY3IS3SWOFTYHWT7Z\",\"WARC-Identified-Payload-Type\":\"application/xhtml+xml\",\"warc_filename\":\"/cc_download/warc_2022/CC-MAIN-2022-27/CC-MAIN-2022-27_segments_1656103271763.15_warc_CC-MAIN-20220626161834-20220626191834-00401.warc.gz\"}"}