1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
28 #include <stddef.h>
29 #include <stdint.h>
32 *
33 * # RSA
34 *
35 * This file documents the RSA implementations provided with BearSSL.
36 * Note that the SSL engine accesses these implementations through a
37 * configurable API, so it is possible to, for instance, run a SSL
38 * server which uses a RSA engine which is not based on this code.
39 *
40 * ## Key Elements
41 *
42 * RSA public and private keys consist in lists of big integers. All
43 * such integers are represented with big-endian unsigned notation:
44 * first byte is the most significant, and the value is positive (so
45 * there is no dedicated "sign bit"). Public and private key structures
46 * thus contain, for each such integer, a pointer to the first value byte
47 * (`unsigned char *`), and a length (`size_t`) which is the number of
48 * relevant bytes. As a general rule, minimal-length encoding is not
49 * enforced: values may have extra leading bytes of value 0.
50 *
51 * RSA public keys consist in two integers:
52 *
53 * - the modulus (`n`);
54 * - the public exponent (`e`).
55 *
56 * RSA private keys, as defined in
57 * [PKCS#1](https://tools.ietf.org/html/rfc3447), contain eight integers:
58 *
59 * - the modulus (`n`);
60 * - the public exponent (`e`);
61 * - the private exponent (`d`);
62 * - the first prime factor (`p`);
63 * - the second prime factor (`q`);
64 * - the first reduced exponent (`dp`, which is `d` modulo `p-1`);
65 * - the second reduced exponent (`dq`, which is `d` modulo `q-1`);
66 * - the CRT coefficient (`iq`, the inverse of `q` modulo `p`).
67 *
68 * However, the implementations defined in BearSSL use only five of
69 * these integers: `p`, `q`, `dp`, `dq` and `iq`.
70 *
71 * ## Security Features and Limitations
72 *
73 * The implementations contained in BearSSL have the following limitations
74 * and features:
75 *
76 * - They are constant-time. This means that the execution time and
77 * memory access pattern may depend on the _lengths_ of the private
78 * key components, but not on their value, nor on the value of
79 * the operand. Note that this property is not achieved through
80 * random masking, but "true" constant-time code.
81 *
82 * - They support only private keys with two prime factors. RSA private
83 * key with three or more prime factors are nominally supported, but
84 * rarely used; they may offer faster operations, at the expense of
85 * more code and potentially a reduction in security if there are
86 * "too many" prime factors.
87 *
88 * - The public exponent may have arbitrary length. Of course, it is
89 * a good idea to keep public exponents small, so that public key
90 * operations are fast; but, contrary to some widely deployed
91 * implementations, BearSSL has no problem with public exponent
92 * longer than 32 bits.
93 *
94 * - The two prime factors of the modulus need not have the same length
95 * (but severely imbalanced factor lengths might reduce security).
96 * Similarly, there is no requirement that the first factor (`p`)
97 * be greater than the second factor (`q`).
98 *
99 * - Prime factors and modulus must be smaller than a compile-time limit.
100 * This is made necessary by the use of fixed-size stack buffers, and
101 * the limit has been adjusted to keep stack usage under 2 kB for the
102 * RSA operations. Currently, the maximum modulus size is 4096 bits,
103 * and the maximum prime factor size is 2080 bits.
104 *
105 * - The RSA functions themselves do not enforce lower size limits,
106 * except that which is absolutely necessary for the operation to
107 * mathematically make sense (e.g. a PKCS#1 v1.5 signature with
108 * SHA-1 requires a modulus of at least 361 bits). It is up to users
109 * of this code to enforce size limitations when appropriate (e.g.
110 * the X.509 validation engine, by default, rejects RSA keys of
111 * less than 1017 bits).
112 *
113 * - Within the size constraints expressed above, arbitrary bit lengths
114 * are supported. There is no requirement that prime factors or
115 * modulus have a size multiple of 8 or 16.
116 *
117 * - When verifying PKCS#1 v1.5 signatures, both variants of the hash
118 * function identifying header (with and without the ASN.1 NULL) are
119 * supported. When producing such signatures, the variant with the
120 * ASN.1 NULL is used.
121 *
122 * ## Implementations
123 *
124 * Three RSA implementations are included:
125 *
126 * - The **i32** implementation internally represents big integers
127 * as arrays of 32-bit integers. It is perfunctory and portable,
128 * but not very efficient.
129 *
130 * - The **i31** implementation uses 32-bit integers, each containing
131 * 31 bits worth of integer data. The i31 implementation is somewhat
132 * faster than the i32 implementation (the reduced integer size makes
133 * carry propagation easier) for a similar code footprint, but uses
134 * very slightly larger stack buffers (about 4% bigger).
135 *
136 * - The **i62** implementation is similar to the i31 implementation,
137 * except that it internally leverages the 64x64->128 multiplication
138 * opcode. This implementation is available only on architectures
139 * where such an opcode exists. It is much faster than i31.
140 *
141 * - The **i15** implementation uses 16-bit integers, each containing
142 * 15 bits worth of integer data. Multiplication results fit on
143 * 32 bits, so this won't use the "widening" multiplication routine
144 * on ARM Cortex M0/M0+, for much better performance and constant-time
145 * execution.
146 */
148 /**
149 * \brief RSA public key.
150 *
151 * The structure references the modulus and the public exponent. Both
152 * integers use unsigned big-endian representation; extra leading bytes
153 * of value 0 are allowed.
154 */
155 typedef struct {
156 /** \brief Modulus. */
157 unsigned char *n;
158 /** \brief Modulus length (in bytes). */
159 size_t nlen;
160 /** \brief Public exponent. */
161 unsigned char *e;
162 /** \brief Public exponent length (in bytes). */
163 size_t elen;
164 } br_rsa_public_key;
166 /**
167 * \brief RSA private key.
168 *
169 * The structure references the primvate factors, reduced private
170 * exponents, and CRT coefficient. It also contains the bit length of
171 * the modulus. The big integers use unsigned big-endian representation;
172 * extra leading bytes of value 0 are allowed. However, the modulus bit
173 * length (`n_bitlen`) MUST be exact.
174 */
175 typedef struct {
176 /** \brief Modulus bit length (in bits, exact value). */
177 uint32_t n_bitlen;
178 /** \brief First prime factor. */
179 unsigned char *p;
180 /** \brief First prime factor length (in bytes). */
181 size_t plen;
182 /** \brief Second prime factor. */
183 unsigned char *q;
184 /** \brief Second prime factor length (in bytes). */
185 size_t qlen;
186 /** \brief First reduced private exponent. */
187 unsigned char *dp;
188 /** \brief First reduced private exponent length (in bytes). */
189 size_t dplen;
190 /** \brief Second reduced private exponent. */
191 unsigned char *dq;
192 /** \brief Second reduced private exponent length (in bytes). */
193 size_t dqlen;
194 /** \brief CRT coefficient. */
195 unsigned char *iq;
196 /** \brief CRT coefficient length (in bytes). */
197 size_t iqlen;
198 } br_rsa_private_key;
200 /**
201 * \brief Type for a RSA public key engine.
202 *
203 * The public key engine performs the modular exponentiation of the
204 * provided value with the public exponent. The value is modified in
205 * place.
206 *
207 * The value length (`xlen`) is verified to have _exactly_ the same
208 * length as the modulus (actual modulus length, without extra leading
209 * zeros in the modulus representation in memory). If the length does
210 * not match, then this function returns 0 and `x[]` is unmodified.
211 *
212 * It `xlen` is correct, then `x[]` is modified. Returned value is 1
213 * on success, 0 on error. Error conditions include an oversized `x[]`
214 * (the array has the same length as the modulus, but the numerical value
215 * is not lower than the modulus) and an invalid modulus (e.g. an even
216 * integer). If an error is reported, then the new contents of `x[]` are
217 * unspecified.
218 *
219 * \param x operand to exponentiate.
220 * \param xlen length of the operand (in bytes).
221 * \param pk RSA public key.
222 * \return 1 on success, 0 on error.
223 */
224 typedef uint32_t (*br_rsa_public)(unsigned char *x, size_t xlen,
225 const br_rsa_public_key *pk);
227 /**
228 * \brief Type for a RSA signature verification engine (PKCS#1 v1.5).
229 *
230 * Parameters are:
231 *
232 * - The signature itself. The provided array is NOT modified.
233 *
234 * - The encoded OID for the hash function. The provided array must begin
235 * with a single byte that contains the length of the OID value (in
236 * bytes), followed by exactly that many bytes. This parameter may
237 * also be `NULL`, in which case the raw hash value should be used
238 * with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
239 * to TLS-1.1, with a 36-byte hash value).
240 *
241 * - The hash output length, in bytes.
242 *
243 * - The public key.
244 *
245 * - An output buffer for the hash value. The caller must still compare
246 * it with the hash of the data over which the signature is computed.
247 *
248 * **Constraints:**
249 *
250 * - Hash length MUST be no more than 64 bytes.
251 *
252 * - OID value length MUST be no more than 32 bytes (i.e. `hash_oid`
253 * must have a value in the 0..32 range, inclusive).
254 *
255 * This function verifies that the signature length (`xlen`) matches the
256 * modulus length (this function returns 0 on mismatch). If the modulus
257 * size exceeds the maximum supported RSA size, then the function also
258 * returns 0.
259 *
260 * Returned value is 1 on success, 0 on error.
261 *
262 * Implementations of this type need not be constant-time.
263 *
264 * \param x signature buffer.
265 * \param xlen signature length (in bytes).
266 * \param hash_oid encoded hash algorithm OID (or `NULL`).
267 * \param hash_len expected hash value length (in bytes).
268 * \param pk RSA public key.
269 * \param hash_out output buffer for the hash value.
270 * \return 1 on success, 0 on error.
271 */
272 typedef uint32_t (*br_rsa_pkcs1_vrfy)(const unsigned char *x, size_t xlen,
273 const unsigned char *hash_oid, size_t hash_len,
274 const br_rsa_public_key *pk, unsigned char *hash_out);
276 /**
277 * \brief Type for a RSA private key engine.
278 *
279 * The `x[]` buffer is modified in place, and its length is inferred from
280 * the modulus length (`x[]` is assumed to have a length of
281 * `(sk->n_bitlen+7)/8` bytes).
282 *
283 * Returned value is 1 on success, 0 on error.
284 *
285 * \param x operand to exponentiate.
286 * \param sk RSA private key.
287 * \return 1 on success, 0 on error.
288 */
289 typedef uint32_t (*br_rsa_private)(unsigned char *x,
290 const br_rsa_private_key *sk);
292 /**
293 * \brief Type for a RSA signature generation engine (PKCS#1 v1.5).
294 *
295 * Parameters are:
296 *
297 * - The encoded OID for the hash function. The provided array must begin
298 * with a single byte that contains the length of the OID value (in
299 * bytes), followed by exactly that many bytes. This parameter may
300 * also be `NULL`, in which case the raw hash value should be used
301 * with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
302 * to TLS-1.1, with a 36-byte hash value).
303 *
304 * - The hash value computes over the data to sign (its length is
305 * expressed in bytes).
306 *
307 * - The RSA private key.
308 *
309 * - The output buffer, that receives the signature.
310 *
311 * Returned value is 1 on success, 0 on error. Error conditions include
312 * a too small modulus for the provided hash OID and value, or some
313 * invalid key parameters. The signature length is exactly
314 * `(sk->n_bitlen+7)/8` bytes.
315 *
316 * This function is expected to be constant-time with regards to the
317 * private key bytes (lengths of the modulus and the individual factors
318 * may leak, though) and to the hashed data.
319 *
320 * \param hash_oid encoded hash algorithm OID (or `NULL`).
321 * \param hash hash value.
322 * \param hash_len hash value length (in bytes).
323 * \param sk RSA private key.
324 * \param x output buffer for the signature value.
325 * \return 1 on success, 0 on error.
326 */
327 typedef uint32_t (*br_rsa_pkcs1_sign)(const unsigned char *hash_oid,
328 const unsigned char *hash, size_t hash_len,
329 const br_rsa_private_key *sk, unsigned char *x);
331 /*
332 * RSA "i32" engine. Integers are internally represented as arrays of
333 * 32-bit integers, and the core multiplication primitive is the
334 * 32x32->64 multiplication.
335 */
337 /**
338 * \brief RSA public key engine "i32".
339 *
340 * \see br_rsa_public
341 *
342 * \param x operand to exponentiate.
343 * \param xlen length of the operand (in bytes).
344 * \param pk RSA public key.
345 * \return 1 on success, 0 on error.
346 */
347 uint32_t br_rsa_i32_public(unsigned char *x, size_t xlen,
348 const br_rsa_public_key *pk);
350 /**
351 * \brief RSA signature verification engine "i32".
352 *
353 * \see br_rsa_pkcs1_vrfy
354 *
355 * \param x signature buffer.
356 * \param xlen signature length (in bytes).
357 * \param hash_oid encoded hash algorithm OID (or `NULL`).
358 * \param hash_len expected hash value length (in bytes).
359 * \param pk RSA public key.
360 * \param hash_out output buffer for the hash value.
361 * \return 1 on success, 0 on error.
362 */
363 uint32_t br_rsa_i32_pkcs1_vrfy(const unsigned char *x, size_t xlen,
364 const unsigned char *hash_oid, size_t hash_len,
365 const br_rsa_public_key *pk, unsigned char *hash_out);
367 /**
368 * \brief RSA private key engine "i32".
369 *
370 * \see br_rsa_private
371 *
372 * \param x operand to exponentiate.
373 * \param sk RSA private key.
374 * \return 1 on success, 0 on error.
375 */
376 uint32_t br_rsa_i32_private(unsigned char *x,
377 const br_rsa_private_key *sk);
379 /**
380 * \brief RSA signature generation engine "i32".
381 *
382 * \see br_rsa_pkcs1_sign
383 *
384 * \param hash_oid encoded hash algorithm OID (or `NULL`).
385 * \param hash hash value.
386 * \param hash_len hash value length (in bytes).
387 * \param sk RSA private key.
388 * \param x output buffer for the hash value.
389 * \return 1 on success, 0 on error.
390 */
391 uint32_t br_rsa_i32_pkcs1_sign(const unsigned char *hash_oid,
392 const unsigned char *hash, size_t hash_len,
393 const br_rsa_private_key *sk, unsigned char *x);
395 /*
396 * RSA "i31" engine. Similar to i32, but only 31 bits are used per 32-bit
397 * word. This uses slightly more stack space (about 4% more) and code
398 * space, but it quite faster.
399 */
401 /**
402 * \brief RSA public key engine "i31".
403 *
404 * \see br_rsa_public
405 *
406 * \param x operand to exponentiate.
407 * \param xlen length of the operand (in bytes).
408 * \param pk RSA public key.
409 * \return 1 on success, 0 on error.
410 */
411 uint32_t br_rsa_i31_public(unsigned char *x, size_t xlen,
412 const br_rsa_public_key *pk);
414 /**
415 * \brief RSA signature verification engine "i31".
416 *
417 * \see br_rsa_pkcs1_vrfy
418 *
419 * \param x signature buffer.
420 * \param xlen signature length (in bytes).
421 * \param hash_oid encoded hash algorithm OID (or `NULL`).
422 * \param hash_len expected hash value length (in bytes).
423 * \param pk RSA public key.
424 * \param hash_out output buffer for the hash value.
425 * \return 1 on success, 0 on error.
426 */
427 uint32_t br_rsa_i31_pkcs1_vrfy(const unsigned char *x, size_t xlen,
428 const unsigned char *hash_oid, size_t hash_len,
429 const br_rsa_public_key *pk, unsigned char *hash_out);
431 /**
432 * \brief RSA private key engine "i31".
433 *
434 * \see br_rsa_private
435 *
436 * \param x operand to exponentiate.
437 * \param sk RSA private key.
438 * \return 1 on success, 0 on error.
439 */
440 uint32_t br_rsa_i31_private(unsigned char *x,
441 const br_rsa_private_key *sk);
443 /**
444 * \brief RSA signature generation engine "i31".
445 *
446 * \see br_rsa_pkcs1_sign
447 *
448 * \param hash_oid encoded hash algorithm OID (or `NULL`).
449 * \param hash hash value.
450 * \param hash_len hash value length (in bytes).
451 * \param sk RSA private key.
452 * \param x output buffer for the hash value.
453 * \return 1 on success, 0 on error.
454 */
455 uint32_t br_rsa_i31_pkcs1_sign(const unsigned char *hash_oid,
456 const unsigned char *hash, size_t hash_len,
457 const br_rsa_private_key *sk, unsigned char *x);
459 /*
460 * RSA "i62" engine. Similar to i31, but internal multiplication use
461 * 64x64->128 multiplications. This is available only on architecture
462 * that offer such an opcode.
463 */
465 /**
466 * \brief RSA public key engine "i62".
467 *
468 * This function is defined only on architecture that offer a 64x64->128
469 * opcode. Use `br_rsa_i62_public_get()` to dynamically obtain a pointer
470 * to that functiom.
471 *
472 * \see br_rsa_public
473 *
474 * \param x operand to exponentiate.
475 * \param xlen length of the operand (in bytes).
476 * \param pk RSA public key.
477 * \return 1 on success, 0 on error.
478 */
479 uint32_t br_rsa_i62_public(unsigned char *x, size_t xlen,
480 const br_rsa_public_key *pk);
482 /**
483 * \brief RSA signature verification engine "i62".
484 *
485 * This function is defined only on architecture that offer a 64x64->128
486 * opcode. Use `br_rsa_i62_pkcs1_vrfy_get()` to dynamically obtain a pointer
487 * to that functiom.
488 *
489 * \see br_rsa_pkcs1_vrfy
490 *
491 * \param x signature buffer.
492 * \param xlen signature length (in bytes).
493 * \param hash_oid encoded hash algorithm OID (or `NULL`).
494 * \param hash_len expected hash value length (in bytes).
495 * \param pk RSA public key.
496 * \param hash_out output buffer for the hash value.
497 * \return 1 on success, 0 on error.
498 */
499 uint32_t br_rsa_i62_pkcs1_vrfy(const unsigned char *x, size_t xlen,
500 const unsigned char *hash_oid, size_t hash_len,
501 const br_rsa_public_key *pk, unsigned char *hash_out);
503 /**
504 * \brief RSA private key engine "i62".
505 *
506 * This function is defined only on architecture that offer a 64x64->128
507 * opcode. Use `br_rsa_i62_private_get()` to dynamically obtain a pointer
508 * to that functiom.
509 *
510 * \see br_rsa_private
511 *
512 * \param x operand to exponentiate.
513 * \param sk RSA private key.
514 * \return 1 on success, 0 on error.
515 */
516 uint32_t br_rsa_i62_private(unsigned char *x,
517 const br_rsa_private_key *sk);
519 /**
520 * \brief RSA signature generation engine "i62".
521 *
522 * This function is defined only on architecture that offer a 64x64->128
523 * opcode. Use `br_rsa_i62_pkcs1_sign_get()` to dynamically obtain a pointer
524 * to that functiom.
525 *
526 * \see br_rsa_pkcs1_sign
527 *
528 * \param hash_oid encoded hash algorithm OID (or `NULL`).
529 * \param hash hash value.
530 * \param hash_len hash value length (in bytes).
531 * \param sk RSA private key.
532 * \param x output buffer for the hash value.
533 * \return 1 on success, 0 on error.
534 */
535 uint32_t br_rsa_i62_pkcs1_sign(const unsigned char *hash_oid,
536 const unsigned char *hash, size_t hash_len,
537 const br_rsa_private_key *sk, unsigned char *x);
539 /**
540 * \brief Get the RSA "i62" implementation (public key operations),
541 * if available.
542 *
543 * \return the implementation, or 0.
544 */
545 br_rsa_public br_rsa_i62_public_get(void);
547 /**
548 * \brief Get the RSA "i62" implementation (PKCS#1 signature verification),
549 * if available.
550 *
551 * \return the implementation, or 0.
552 */
553 br_rsa_pkcs1_vrfy br_rsa_i62_pkcs1_vrfy_get(void);
555 /**
556 * \brief Get the RSA "i62" implementation (private key operations),
557 * if available.
558 *
559 * \return the implementation, or 0.
560 */
561 br_rsa_private br_rsa_i62_private_get(void);
563 /**
564 * \brief Get the RSA "i62" implementation (PKCS#1 signature generation),
565 * if available.
566 *
567 * \return the implementation, or 0.
568 */
569 br_rsa_pkcs1_sign br_rsa_i62_pkcs1_sign_get(void);
571 /*
572 * RSA "i15" engine. Integers are represented as 15-bit integers, so
573 * the code uses only 32-bit multiplication (no 64-bit result), which
574 * is vastly faster (and constant-time) on the ARM Cortex M0/M0+.
575 */
577 /**
578 * \brief RSA public key engine "i15".
579 *
580 * \see br_rsa_public
581 *
582 * \param x operand to exponentiate.
583 * \param xlen length of the operand (in bytes).
584 * \param pk RSA public key.
585 * \return 1 on success, 0 on error.
586 */
587 uint32_t br_rsa_i15_public(unsigned char *x, size_t xlen,
588 const br_rsa_public_key *pk);
590 /**
591 * \brief RSA signature verification engine "i15".
592 *
593 * \see br_rsa_pkcs1_vrfy
594 *
595 * \param x signature buffer.
596 * \param xlen signature length (in bytes).
597 * \param hash_oid encoded hash algorithm OID (or `NULL`).
598 * \param hash_len expected hash value length (in bytes).
599 * \param pk RSA public key.
600 * \param hash_out output buffer for the hash value.
601 * \return 1 on success, 0 on error.
602 */
603 uint32_t br_rsa_i15_pkcs1_vrfy(const unsigned char *x, size_t xlen,
604 const unsigned char *hash_oid, size_t hash_len,
605 const br_rsa_public_key *pk, unsigned char *hash_out);
607 /**
608 * \brief RSA private key engine "i15".
609 *
610 * \see br_rsa_private
611 *
612 * \param x operand to exponentiate.
613 * \param sk RSA private key.
614 * \return 1 on success, 0 on error.
615 */
616 uint32_t br_rsa_i15_private(unsigned char *x,
617 const br_rsa_private_key *sk);
619 /**
620 * \brief RSA signature generation engine "i15".
621 *
622 * \see br_rsa_pkcs1_sign
623 *
624 * \param hash_oid encoded hash algorithm OID (or `NULL`).
625 * \param hash hash value.
626 * \param hash_len hash value length (in bytes).
627 * \param sk RSA private key.
628 * \param x output buffer for the hash value.
629 * \return 1 on success, 0 on error.
630 */
631 uint32_t br_rsa_i15_pkcs1_sign(const unsigned char *hash_oid,
632 const unsigned char *hash, size_t hash_len,
633 const br_rsa_private_key *sk, unsigned char *x);
635 /**
636 * \brief Get "default" RSA implementation (public-key operations).
637 *
638 * This returns the preferred implementation of RSA (public-key operations)
639 * on the current system.
640 *
641 * \return the default implementation.
642 */
643 br_rsa_public br_rsa_public_get_default(void);
645 /**
646 * \brief Get "default" RSA implementation (private-key operations).
647 *
648 * This returns the preferred implementation of RSA (private-key operations)
649 * on the current system.
650 *
651 * \return the default implementation.
652 */
653 br_rsa_private br_rsa_private_get_default(void);
655 /**
656 * \brief Get "default" RSA implementation (PKCS#1 signature verification).
657 *
658 * This returns the preferred implementation of RSA (signature verification)
659 * on the current system.
660 *
661 * \return the default implementation.
662 */
663 br_rsa_pkcs1_vrfy br_rsa_pkcs1_vrfy_get_default(void);
665 /**
666 * \brief Get "default" RSA implementation (PKCS#1 signature generation).
667 *
668 * This returns the preferred implementation of RSA (signature generation)
669 * on the current system.
670 *
671 * \return the default implementation.
672 */
673 br_rsa_pkcs1_sign br_rsa_pkcs1_sign_get_default(void);
675 /**
676 * \brief RSA decryption helper, for SSL/TLS.
677 *
678 * This function performs the RSA decryption for a RSA-based key exchange
679 * in a SSL/TLS server. The provided RSA engine is used. The `data`
680 * parameter points to the value to decrypt, of length `len` bytes. On
681 * success, the 48-byte pre-master secret is copied into `data`, starting
682 * at the first byte of that buffer; on error, the contents of `data`
683 * become indeterminate.
684 *
685 * This function first checks that the provided value length (`len`) is
686 * not lower than 59 bytes, and matches the RSA modulus length; if neither
687 * of this property is met, then this function returns 0 and the buffer
688 * is unmodified.
689 *
690 * Otherwise, decryption and then padding verification are performed, both
691 * in constant-time. A decryption error, or a bad padding, or an
692 * incorrect decrypted value length are reported with a returned value of
693 * 0; on success, 1 is returned. The caller (SSL server engine) is supposed
694 * to proceed with a random pre-master secret in case of error.
695 *
696 * \param core RSA private key engine.
697 * \param sk RSA private key.
698 * \param data input/output buffer.
699 * \param len length (in bytes) of the data to decrypt.
700 * \return 1 on success, 0 on error.
701 */
702 uint32_t br_rsa_ssl_decrypt(br_rsa_private core, const br_rsa_private_key *sk,
703 unsigned char *data, size_t len);
705 #endif
{"ft_lang_label":"__label__en","ft_lang_prob":0.67223155,"math_prob":0.8631948,"size":24026,"snap":"2021-43-2021-49","text_gpt3_token_len":6231,"char_repetition_ratio":0.18016818,"word_repetition_ratio":0.18093856,"special_character_ratio":0.3314326,"punctuation_ratio":0.12447455,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.9566099,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2021-12-05T13:34:04Z\",\"WARC-Record-ID\":\"<urn:uuid:b1e19de3-61df-4a94-8300-4edfa2b04888>\",\"Content-Length\":\"171646\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:747ad5ca-9a84-4c85-9db3-7a418b6bad96>\",\"WARC-Concurrent-To\":\"<urn:uuid:a47c04eb-39ca-41b4-abda-2d4de5141f3e>\",\"WARC-IP-Address\":\"158.69.204.153\",\"WARC-Target-URI\":\"https://www.bearssl.org/gitweb/?p=BearSSL;a=blob;f=inc/bearssl_rsa.h;hb=8b2fe3add686db5cbd977e75d3bef02fa4c98c8f\",\"WARC-Payload-Digest\":\"sha1:6KFTBXAIC4LOGB4J5EKQTXHUOCNOSNJR\",\"WARC-Block-Digest\":\"sha1:NTJMLSOZ53KP4CTXART7VIC5HHK6GZ3N\",\"WARC-Identified-Payload-Type\":\"application/xhtml+xml\",\"warc_filename\":\"/cc_download/warc_2021/CC-MAIN-2021-49/CC-MAIN-2021-49_segments_1637964363189.92_warc_CC-MAIN-20211205130619-20211205160619-00196.warc.gz\"}"}