2  *  The RSA public-key cryptosystem
10  *  of the RSA algorithm:
30 #include "mbedtls/rsa.h"
57  * - never a valid value for an RSA parameter
81 int mbedtls_rsa_parse_key(mbedtls_rsa_context *rsa, const unsigned char *key, size_t keylen)  in mbedtls_rsa_parse_key()  argument
128         (ret = mbedtls_rsa_import(rsa, &T, NULL, NULL,  in mbedtls_rsa_parse_key()
135         (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL,  in mbedtls_rsa_parse_key()
142         (ret = mbedtls_rsa_import(rsa, NULL, NULL, NULL,  in mbedtls_rsa_parse_key()
149         (ret = mbedtls_rsa_import(rsa, NULL, &T, NULL,  in mbedtls_rsa_parse_key()
156         (ret = mbedtls_rsa_import(rsa, NULL, NULL, &T,  in mbedtls_rsa_parse_key()
163      * The RSA CRT parameters DP, DQ and QP are nominally redundant, in  in mbedtls_rsa_parse_key()
167      * RSA private keys into memory and also avoids side channels which  in mbedtls_rsa_parse_key()
175         (ret = mbedtls_mpi_copy(&rsa->DP, &T)) != 0) {  in mbedtls_rsa_parse_key()
181         (ret = mbedtls_mpi_copy(&rsa->DQ, &T)) != 0) {  in mbedtls_rsa_parse_key()
187         (ret = mbedtls_mpi_copy(&rsa->QP, &T)) != 0) {  in mbedtls_rsa_parse_key()
209     if ((ret = mbedtls_rsa_complete(rsa)) != 0 ||  in mbedtls_rsa_parse_key()
210         (ret = mbedtls_rsa_check_pubkey(rsa)) != 0) {  in mbedtls_rsa_parse_key()
223         mbedtls_rsa_free(rsa);  in mbedtls_rsa_parse_key()
229 int mbedtls_rsa_parse_pubkey(mbedtls_rsa_context *rsa, const unsigned char *key, size_t keylen)  in mbedtls_rsa_parse_pubkey()  argument
257     if ((ret = mbedtls_rsa_import_raw(rsa, p, len, NULL, 0, NULL, 0,  in mbedtls_rsa_parse_pubkey()
269     if ((ret = mbedtls_rsa_import_raw(rsa, NULL, 0, NULL, 0, NULL, 0,  in mbedtls_rsa_parse_pubkey()
276     if (mbedtls_rsa_complete(rsa) != 0 ||  in mbedtls_rsa_parse_pubkey()
277         mbedtls_rsa_check_pubkey(rsa) != 0) {  in mbedtls_rsa_parse_pubkey()
288 int mbedtls_rsa_write_key(const mbedtls_rsa_context *rsa, unsigned char *start,  in mbedtls_rsa_write_key()  argument
303     if ((ret = mbedtls_rsa_export_crt(rsa, NULL, NULL, &T)) != 0 ||  in mbedtls_rsa_write_key()
310     if ((ret = mbedtls_rsa_export_crt(rsa, NULL, &T, NULL)) != 0 ||  in mbedtls_rsa_write_key()
317     if ((ret = mbedtls_rsa_export_crt(rsa, &T, NULL, NULL)) != 0 ||  in mbedtls_rsa_write_key()
324     if ((ret = mbedtls_rsa_export(rsa, NULL, NULL, &T, NULL, NULL)) != 0 ||  in mbedtls_rsa_write_key()
331     if ((ret = mbedtls_rsa_export(rsa, NULL, &T, NULL, NULL, NULL)) != 0 ||  in mbedtls_rsa_write_key()
338     if ((ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, &T, NULL)) != 0 ||  in mbedtls_rsa_write_key()
345     if ((ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &T)) != 0 ||  in mbedtls_rsa_write_key()
352     if ((ret = mbedtls_rsa_export(rsa, &T, NULL, NULL, NULL, NULL)) != 0 ||  in mbedtls_rsa_write_key()
380 int mbedtls_rsa_write_pubkey(const mbedtls_rsa_context *rsa, unsigned char *start,  in mbedtls_rsa_write_pubkey()  argument
390     if ((ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &T)) != 0 ||  in mbedtls_rsa_write_pubkey()
397     if ((ret = mbedtls_rsa_export(rsa, &T, NULL, NULL, NULL, NULL)) != 0 ||  in mbedtls_rsa_write_pubkey()
502      * validity through timing. RSA keys are small enough that all the  in mbedtls_ct_rsaes_pkcs1_v15_unpadding()
637  * that the RSA primitives will be able to execute without error.
659      * RSA public key operations. */  in rsa_check_context()
802      *         to our current RSA implementation.  in mbedtls_rsa_complete()
914  * write DER encoded RSA keys. The helper function mbedtls_rsa_deduce_crt
953  * Initialize an RSA context
971  * Set padding for an existing RSA context
1007  * Get padding mode of initialized RSA context
1023  * Get length in bits of RSA modulus
1031  * Get length in bytes of RSA modulus
1041  * Generate an RSA keypair
1043  * This generation method follows the RSA key pair generation procedure of
1057      * the RSA algorithm is less than or equal to 80 bits and therefore an error  in mbedtls_rsa_gen_key()
1169  * Check a public RSA key
1191  * Check for the consistency of all fields in an RSA private key context
1235  * Do an RSA public key operation
1286  *  KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
1389  * traces of measurements to recover the RSA key. The more collisions are there,
1399  * bit RSA requires approximately as much time as trying out 2^112 random keys.
1409  * Do an RSA private key operation
1887  * Add the message padding, then do an RSA operation
1959      * RSA operation  in mbedtls_rsa_rsaes_oaep_decrypt()
2087  * Do an RSA operation, then remove the message padding
2433  * Do an RSA operation to sign the message digest
2502  * Do an RSA operation to sign the message digest
2715      * Apply RSA primitive to get what should be PKCS1 encoded hash.  in mbedtls_rsa_rsassa_pkcs1_v15_verify()
2748  * Do an RSA operation and check the message digest
2779  * Copy the components of an RSA key
2819  * Free the components of an RSA key
2859  * Example RSA-1024 keypair, for test purposes
2930     mbedtls_rsa_context rsa;  in mbedtls_rsa_self_test()  local
2941     mbedtls_rsa_init(&rsa);  in mbedtls_rsa_self_test()
2944     MBEDTLS_MPI_CHK(mbedtls_rsa_import(&rsa, &K, NULL, NULL, NULL, NULL));  in mbedtls_rsa_self_test()
2946     MBEDTLS_MPI_CHK(mbedtls_rsa_import(&rsa, NULL, &K, NULL, NULL, NULL));  in mbedtls_rsa_self_test()
2948     MBEDTLS_MPI_CHK(mbedtls_rsa_import(&rsa, NULL, NULL, &K, NULL, NULL));  in mbedtls_rsa_self_test()
2950     MBEDTLS_MPI_CHK(mbedtls_rsa_import(&rsa, NULL, NULL, NULL, &K, NULL));  in mbedtls_rsa_self_test()
2952     MBEDTLS_MPI_CHK(mbedtls_rsa_import(&rsa, NULL, NULL, NULL, NULL, &K));  in mbedtls_rsa_self_test()
2954     MBEDTLS_MPI_CHK(mbedtls_rsa_complete(&rsa));  in mbedtls_rsa_self_test()
2957         mbedtls_printf("  RSA key validation: ");  in mbedtls_rsa_self_test()
2960     if (mbedtls_rsa_check_pubkey(&rsa) != 0 ||  in mbedtls_rsa_self_test()
2961         mbedtls_rsa_check_privkey(&rsa) != 0) {  in mbedtls_rsa_self_test()
2976     if (mbedtls_rsa_pkcs1_encrypt(&rsa, myrand, NULL,  in mbedtls_rsa_self_test()
2991     if (mbedtls_rsa_pkcs1_decrypt(&rsa, myrand, NULL,  in mbedtls_rsa_self_test()
3029     if (mbedtls_rsa_pkcs1_sign(&rsa, myrand, NULL,  in mbedtls_rsa_self_test()
3044     if (mbedtls_rsa_pkcs1_verify(&rsa, MBEDTLS_MD_SHA1, 20,  in mbedtls_rsa_self_test()
3065     mbedtls_rsa_free(&rsa);  in mbedtls_rsa_self_test()