commit 181b5c0bd8827845c35801304f6431c80ed51a81
parent 138916299ef60d413ed6fa22b4ddcfd6f0d53ac9
Author: Armin Preiml <apreiml@strohwolke.at>
Date: Tue, 29 Nov 2022 13:23:59 +0100
add crypto::rsa core functions
The core functions [[pubexp]] and [[privexp]] are ported from BearSSL.
I've chosen 4096-bit as maximum key size per default similar to BearSSL.
4096-bit is a reasonable size. Bigger keys will not improve security
that much in relation to how much more computational ressources they
require. If bigger keys are required, the [[BITSIZE]] parameter can be
changed at compile time.
This module requires the keys to be stored in byte slices, sinces they
are way simpler to handle. It allows to have a small number of init
functions, that prepare the keys and already do some basic checks.
On the other hand if keys are represented as structs, many more helpers
would be required to calculate the parameters, since not all key formats
store all parameters that we require. Key validation will need to go to
the core validations or into extra functions. That way the api would
have more moving parts. So the overhead of copying the parameters into byte
slices is worth trading for the simpler api design.
Signed-off-by: Armin Preiml <apreiml@strohwolke.at>
Diffstat:
6 files changed, 1238 insertions(+), 0 deletions(-)
diff --git a/crypto/rsa/+test/core.ha b/crypto/rsa/+test/core.ha
@@ -0,0 +1,159 @@
+// License: MPL-2.0
+// (c) 2022 Armin Preiml <apreiml@strohwolke.at>
+use bytes;
+use crypto::bigint::*;
+
+let pubbuf: [PUBEXP_BUFSIZE]u8 = [0...];
+let privbuf: [PRIVEXP_BUFSIZE]u8 = [0...];
+let pkcs1_verifybuf: [PKCS1_VERIFYBUFSIZE]u8 = [0...];
+let pkcs1_signbuf: [PKCS1_SIGNBUFSIZE]u8 = [0...];
+
+@test fn tiny() void = {
+ let pub = pubparams {
+ e = [0x01, 0x00, 0x01],
+ n = [0x1, 0x87],
+ ...
+ };
+
+ let msg: []u8 = [0x00, 0xc];
+
+ pubexp(&pub, msg, pubbuf)!;
+ assert(bytes::equal(msg, [0x01, 0x2d]));
+};
+
+@test fn smallprivexp() void = {
+ let priv = privparams {
+ nbitlen = 200,
+ p = [
+ 0x0a, 0xd2, 0xbe, 0xc0, 0xbf, 0x9a, 0xfa, 0x3b, 0x64,
+ 0x7a, 0x27, 0x33, 0x59,
+ ],
+ q = [
+ 0x0c, 0xfd, 0x9a, 0xec, 0x42, 0xcd, 0xce, 0xc0, 0xc5,
+ 0x43, 0x31, 0xbf, 0x33,
+ ],
+ dp = [
+ 0x03, 0x3c, 0x37, 0xb4, 0xda, 0x11, 0x73, 0x57, 0x29,
+ 0x93, 0xb2, 0x00, 0x11,
+ ],
+ dq = [
+ 0x01, 0xde, 0xde, 0xd9, 0x18, 0x81, 0x84, 0x3d, 0x13,
+ 0xea, 0xaa, 0x16, 0x2b,
+ ],
+ iq = [
+ 0x08, 0x24, 0xbc, 0x1a, 0xea, 0xcc, 0xdf, 0xe1, 0x5a,
+ 0x0a, 0x6f, 0x32, 0xa8,
+ ],
+ ...
+ };
+
+ let x: [_]u8 = [
+ 0x0c, 0x5b, 0xea, 0x82, 0x38, 0xc2, 0xfc, 0x7a, 0x2c, 0xe3,
+ 0xc1, 0x39, 0x44, 0x5b, 0x21, 0xc2, 0xa4, 0x6e, 0xb1, 0x7b,
+ 0xeb, 0xbb, 0xd4, 0xea, 0xfc,
+ ];
+
+ const expected: [_]u8 = [
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0xcc, 0x07, 0xc9,
+ ];
+
+ privexp(&priv, x, privbuf)!;
+
+ assert(bytes::equal(expected, x));
+};
+
+@test fn pubprivexp() void = {
+ const x: [_]u8 = [
+ 0x6e, 0xb5, 0x5f, 0xbd, 0x48, 0x09, 0x08, 0x7c, 0x01, 0xb3,
+ 0x74, 0x26, 0x73, 0x9d, 0x3e, 0xd5, 0x08, 0x7d, 0xe8, 0x11,
+ 0x01, 0x21, 0x31, 0x11, 0x91, 0x34, 0x5b, 0xe5, 0x6c, 0x37,
+ 0x79, 0x7b, 0xdb, 0x75, 0x16, 0x62, 0x0e, 0x7d, 0x1d, 0xd1,
+ 0x04, 0x45, 0xbc, 0xa9, 0x79, 0xd0, 0xb1, 0x1d, 0x1e, 0x20,
+ 0x65, 0x37, 0x92, 0x90, 0xa8, 0xd3, 0x5f, 0x07, 0x24, 0x54,
+ 0x53, 0x97, 0x69, 0x84, 0xe2, 0xbb, 0xc0, 0xb5, 0x82, 0x4f,
+ 0x29, 0xac, 0xc9, 0x07, 0xa7, 0x75, 0x08, 0x1c, 0x0c, 0x72,
+ 0x9f, 0x35, 0x1b, 0x75, 0xb2, 0x79, 0x3f, 0x41, 0xa5, 0xcb,
+ 0x9d, 0x69, 0x02, 0xa8, 0x08, 0xfe, 0x11, 0x19, 0x2f, 0xc2,
+ 0xdb, 0x0e, 0xa6, 0xe0, 0xc4, 0x44, 0x33, 0xd6, 0xad, 0x59,
+ 0x11, 0xa7, 0x38, 0xc0, 0xe7, 0x37, 0x21, 0xa8, 0x13, 0x96,
+ 0xe9, 0x63, 0x25, 0xd9, 0x2e, 0xbf, 0x10, 0x59, 0x49, 0xdd,
+ 0xc0, 0x55, 0xeb, 0x6d, 0xbe, 0x0a, 0x1e, 0xe2, 0x62, 0xce,
+ 0x53, 0x2e, 0xaa, 0xed, 0xe5, 0x7e, 0xf7, 0x1b, 0xbb, 0x09,
+ 0x75, 0x5e, 0x5f, 0xf9, 0x78, 0x12, 0x51, 0xa4, 0x63, 0x52,
+ 0xa4, 0xba, 0x45, 0xbc, 0x48, 0x89, 0xb2, 0x73, 0xb4, 0xa5,
+ 0x25, 0xd3, 0x1a, 0xd5, 0x9d, 0xff, 0x4e, 0xba, 0xd0, 0xb0,
+ 0xb5, 0x21, 0x11, 0x25, 0x4d, 0x84, 0x90, 0x6e, 0xcd, 0x68,
+ 0xd6, 0xd7, 0x39, 0xf7, 0x03, 0xb5, 0x7e, 0x78, 0x7e, 0x33,
+ 0x2c, 0x7f, 0x34, 0x8f, 0x6f, 0xb2, 0x24, 0xe0, 0x5f, 0xd6,
+ 0x18, 0x42, 0x4d, 0xb4, 0x5b, 0xe5, 0xc6, 0x92, 0xde, 0x54,
+ 0x37, 0x69, 0x36, 0x7d, 0xe0, 0x0b, 0xa2, 0x6a, 0xb7, 0x41,
+ 0xf4, 0x23, 0x09, 0x7f, 0x26, 0x64, 0xff, 0x10, 0x8a, 0x28,
+ 0x34, 0xca, 0x08, 0x81, 0xf5, 0x38, 0x58, 0x46, 0xd2, 0xc0,
+ 0x1c, 0x35, 0x31, 0x69, 0xcc, 0x4a, 0xed, 0x04, 0x22, 0x06,
+ 0xbf, 0x79, 0x62, 0x0e, 0x43, 0x5e, 0x90, 0xf3, 0x95, 0x6b,
+ 0x6e, 0xc3, 0x80, 0x9c, 0x63, 0xd1, 0xf7, 0xf2, 0x9f, 0x83,
+ 0xb2, 0x09, 0x08, 0xcf, 0xb3, 0x87, 0x79, 0xc6, 0x24, 0xe6,
+ 0x98, 0x58, 0xda, 0xdc, 0x0c, 0x67, 0x4c, 0x1f, 0xe7, 0xc3,
+ 0x26, 0xec, 0xdd, 0x7e, 0x91, 0xb0, 0x31, 0x99, 0x5c, 0x93,
+ 0x52, 0x17, 0xa2, 0x0f, 0xb1, 0xfb, 0x09, 0xd2, 0xa9, 0xe5,
+ 0xdf, 0x1e, 0x5c, 0xa8, 0xf5, 0x0c, 0x20, 0xc3, 0xe3, 0x07,
+ 0x32, 0x1b, 0x42, 0xc1, 0x58, 0xb2, 0x1c, 0x52, 0x7d, 0x56,
+ 0xf8, 0x0c, 0xad, 0x03, 0xf5, 0x40, 0x07, 0x9c, 0xf4, 0x41,
+ 0xf5, 0x54, 0xed, 0x66, 0x11, 0xd6, 0x98, 0xa4, 0x32, 0xd2,
+ 0x94, 0x02, 0x74, 0xa9, 0xe1, 0x3a, 0x61, 0x18, 0x37, 0x54,
+ 0xce, 0x03, 0x17, 0xc9, 0xc9, 0x99, 0x22, 0xd7, 0x3f, 0x71,
+ 0x7f, 0xf5, 0x8d, 0xa3,
+ ];
+
+ const result: [_]u8 = [
+ 0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0x00, 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
+ 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40,
+ 0xcd, 0xcc, 0x9b, 0x65, 0xfe, 0xa7, 0xb2, 0x4d, 0xb6, 0xae,
+ 0xb7, 0xfb, 0xcb, 0x78, 0xb6, 0x10, 0x64, 0xcd, 0x9a, 0xdb,
+ 0x81, 0x4f, 0xc0, 0x8a, 0x17, 0xd3, 0xc0, 0x6b, 0xa2, 0xdd,
+ 0xbc, 0x61, 0xeb, 0xbf, 0xe2, 0x8e, 0x91, 0xf2, 0xd6, 0x75,
+ 0xa2, 0x5b, 0x0e, 0x61, 0x85, 0x74, 0xda, 0xcc, 0x94, 0x59,
+ 0xc4, 0x4b, 0x95, 0x0f, 0x80, 0xf6, 0x5e, 0xd4, 0x68, 0x09,
+ 0x65, 0x5f, 0x28, 0x85,
+ ];
+
+ let xc = alloc(x);
+ defer free(xc);
+
+ pubexp(&sign3072.pub, xc, pubbuf)!;
+ assert(bytes::equal(result, xc));
+ privexp(&sign3072.priv, xc, privbuf)!;
+ assert(bytes::equal(x, xc));
+};
diff --git a/crypto/rsa/+test/keys.ha b/crypto/rsa/+test/keys.ha
@@ -0,0 +1,484 @@
+// License: MPL-2.0
+// (c) 2022 Armin Preiml <apreiml@strohwolke.at>
+use bytes;
+
+type keypair = struct {
+ pub: pubparams,
+ priv: privparams,
+ d: []u8,
+};
+
+let sign3072: keypair = keypair {
+ pub = pubparams {
+ n = [
+ 0xe1, 0x83, 0x1c, 0x9d, 0xa1, 0x19, 0xe5, 0x74, 0x86,
+ 0x07, 0x85, 0x50, 0x96, 0x21, 0x62, 0x11, 0xdd, 0x80,
+ 0xca, 0xe2, 0x2b, 0xf0, 0x22, 0x11, 0x83, 0xf0, 0x35,
+ 0x65, 0xc6, 0x1c, 0x54, 0x18, 0xc6, 0x58, 0xd8, 0x2e,
+ 0x32, 0xed, 0xa0, 0x84, 0x65, 0x24, 0xe5, 0x96, 0x79,
+ 0xda, 0x05, 0x43, 0x65, 0x83, 0x56, 0xe7, 0x5c, 0xed,
+ 0x2f, 0x82, 0x56, 0x04, 0x2f, 0x47, 0x4b, 0xdf, 0x7d,
+ 0x7c, 0xd5, 0xf2, 0x07, 0xbb, 0x44, 0x43, 0x78, 0x18,
+ 0x14, 0xc1, 0x00, 0x44, 0x16, 0xca, 0x6c, 0x08, 0x53,
+ 0x1c, 0x19, 0x76, 0x51, 0xcf, 0x4a, 0x25, 0x33, 0xca,
+ 0x1e, 0xf3, 0x0d, 0x31, 0x2a, 0x6a, 0x6f, 0x77, 0x1f,
+ 0xe4, 0x55, 0xe9, 0x01, 0xea, 0x7c, 0x1d, 0x41, 0x70,
+ 0xb7, 0x39, 0x2e, 0xb9, 0x05, 0x79, 0x47, 0xe9, 0xae,
+ 0x14, 0xeb, 0x38, 0xfe, 0xc8, 0x57, 0x8d, 0xfe, 0x1b,
+ 0x68, 0x66, 0x34, 0xb1, 0x80, 0xf6, 0xf8, 0x8a, 0x82,
+ 0xe8, 0x60, 0x1b, 0x3a, 0xf7, 0xcc, 0x51, 0xdf, 0xd3,
+ 0xb4, 0x67, 0xbf, 0xae, 0xb2, 0x6d, 0xa0, 0x7f, 0xdf,
+ 0x08, 0xdf, 0xc4, 0x1d, 0xf9, 0x15, 0xad, 0x68, 0xe8,
+ 0x71, 0xce, 0xf2, 0x5a, 0x0d, 0x1d, 0x92, 0x87, 0x77,
+ 0x88, 0x05, 0x9c, 0xb6, 0x7d, 0x08, 0x33, 0x7a, 0x94,
+ 0xcf, 0x53, 0x80, 0x04, 0x16, 0xe6, 0x03, 0x14, 0x54,
+ 0x53, 0x7d, 0xb2, 0xe5, 0x8c, 0x80, 0x64, 0xe7, 0x14,
+ 0xdf, 0xbd, 0xf9, 0x07, 0xbe, 0xa6, 0xb1, 0x1e, 0x4d,
+ 0x65, 0xfa, 0x0a, 0x18, 0x10, 0x45, 0x83, 0x39, 0x0e,
+ 0x9b, 0xa0, 0x86, 0xa7, 0x0b, 0xb7, 0x58, 0x58, 0x82,
+ 0x52, 0x17, 0x53, 0x7c, 0xfe, 0xcf, 0x55, 0x0e, 0x61,
+ 0xd8, 0xd4, 0xbc, 0xe9, 0x87, 0x21, 0x65, 0x74, 0xe8,
+ 0x0a, 0xab, 0x43, 0x98, 0x3a, 0x83, 0x72, 0xaf, 0xd0,
+ 0x7f, 0x93, 0xd4, 0x39, 0xa6, 0x09, 0xc8, 0x1d, 0xf1,
+ 0x06, 0x25, 0x95, 0x9e, 0x13, 0x55, 0x06, 0x28, 0x03,
+ 0xb2, 0x3c, 0xf2, 0x3a, 0xb0, 0x8c, 0xba, 0x4e, 0x05,
+ 0x19, 0xbb, 0x98, 0x02, 0xca, 0x8d, 0x4d, 0xd2, 0xff,
+ 0x8a, 0xa5, 0x34, 0x8a, 0x06, 0x15, 0xc0, 0xc3, 0xf6,
+ 0x1b, 0xb8, 0x5e, 0xd7, 0xb9, 0x28, 0x39, 0x8c, 0x96,
+ 0xdb, 0x85, 0x56, 0x21, 0xba, 0xff, 0x7b, 0x5f, 0x25,
+ 0x47, 0xb5, 0x2e, 0x6c, 0x70, 0x73, 0xab, 0x13, 0x4d,
+ 0x24, 0xa8, 0xb3, 0x73, 0xd7, 0x7f, 0xd8, 0xb3, 0xe4,
+ 0xdf, 0x94, 0x9c, 0x48, 0xd6, 0x80, 0x0b, 0x8b, 0xd1,
+ 0xd4, 0x29, 0xb9, 0xa2, 0xef, 0xab, 0x1e, 0x8d, 0xa7,
+ 0x74, 0xa2, 0xc7, 0xe3, 0x89, 0xb5, 0x01, 0xcf, 0xf0,
+ 0xc2, 0x28, 0x4d, 0x8e, 0x60, 0x42, 0x37, 0xbe, 0x18,
+ 0x61, 0x29, 0x8d, 0x01, 0xe6, 0xf9, 0xb5, 0xa7, 0xc5,
+ 0xb7, 0xce, 0xa8, 0x85, 0x61, 0x1b,
+ ],
+ e = [0x01, 0x00, 0x01],
+ ...
+ },
+ priv = privparams {
+ nbitlen = 3072,
+ p = [
+ 0x00, 0xff, 0xce, 0xa3, 0x93, 0x98, 0xe2, 0x7b, 0x85,
+ 0xab, 0xfe, 0x6d, 0x3b, 0xb3, 0xfb, 0xa4, 0xca, 0xbe,
+ 0x21, 0x7f, 0xa9, 0x09, 0x40, 0xe1, 0xf0, 0x10, 0xcf,
+ 0xee, 0x9b, 0x23, 0xea, 0xff, 0xe7, 0x52, 0x28, 0x38,
+ 0x51, 0x3b, 0xd4, 0x5b, 0xb7, 0xef, 0x4b, 0x7a, 0x23,
+ 0xa8, 0xff, 0xa3, 0x41, 0xd9, 0xc1, 0x7b, 0xf4, 0x7d,
+ 0x7a, 0xa6, 0x4f, 0x28, 0x66, 0x25, 0x6b, 0xda, 0x96,
+ 0x97, 0x75, 0x8a, 0xd9, 0x3b, 0xb2, 0x48, 0x5a, 0xe7,
+ 0x06, 0x37, 0x18, 0x0f, 0xb0, 0x3f, 0x0f, 0x1c, 0x38,
+ 0x63, 0xe3, 0x16, 0x5c, 0xa0, 0xfe, 0xea, 0xc0, 0x08,
+ 0x4d, 0xfc, 0x34, 0x28, 0x18, 0xd1, 0xa1, 0x51, 0x8c,
+ 0xb1, 0x58, 0xb2, 0xbc, 0xad, 0xc0, 0xa8, 0x6b, 0x7f,
+ 0xf2, 0xf9, 0xbc, 0xb5, 0xc7, 0x3f, 0x1f, 0x1a, 0x44,
+ 0x75, 0xfe, 0x9f, 0xd1, 0x96, 0x8b, 0x7f, 0x03, 0xe7,
+ 0x0a, 0x58, 0x67, 0xb1, 0xf4, 0x0d, 0x77, 0xc9, 0x31,
+ 0xde, 0xda, 0xf2, 0x16, 0x1e, 0x02, 0xb7, 0xfc, 0x17,
+ 0x93, 0xd7, 0x6d, 0x08, 0x73, 0xda, 0x92, 0x12, 0x49,
+ 0xf2, 0x86, 0x93, 0xcd, 0x60, 0xb8, 0x00, 0xe2, 0xbc,
+ 0xf7, 0x7e, 0x2c, 0xb1, 0x1c, 0x3f, 0x74, 0xf0, 0x01,
+ 0x53, 0x25, 0x11, 0x47, 0x89, 0xe7, 0x4d, 0x6f, 0x06,
+ 0x9b, 0x43, 0x9e, 0xab, 0x47, 0x9f, 0x83, 0x45, 0x40,
+ 0x95, 0x3f, 0x83, 0xff,
+ ],
+ q = [
+ 0x00, 0xe1, 0xae, 0xa0, 0x84, 0xac, 0xc1, 0xa4, 0xba,
+ 0xf9, 0x4b, 0x00, 0x65, 0xa7, 0x89, 0xf0, 0x92, 0x34,
+ 0x62, 0x58, 0x5a, 0x1c, 0xcf, 0x4b, 0xb2, 0xda, 0x5f,
+ 0xab, 0x11, 0x6e, 0x78, 0x91, 0x56, 0x9d, 0x8b, 0xb1,
+ 0xdb, 0x5a, 0x68, 0xb7, 0x5d, 0x39, 0x76, 0xac, 0x77,
+ 0xd7, 0x2c, 0xea, 0xd8, 0xac, 0xa1, 0xc6, 0xbe, 0x87,
+ 0xe4, 0xca, 0xa8, 0x00, 0x85, 0x2b, 0x8a, 0x9c, 0x53,
+ 0x89, 0x3f, 0xdf, 0x84, 0x6a, 0x8e, 0x6e, 0xb2, 0xc0,
+ 0x2a, 0x56, 0xd9, 0x43, 0xee, 0xca, 0x43, 0x6a, 0x4d,
+ 0x04, 0x59, 0xe1, 0xd4, 0x5b, 0x11, 0x3d, 0xea, 0x5b,
+ 0xe1, 0x11, 0xa2, 0xfc, 0xca, 0x77, 0xd7, 0x3a, 0xbc,
+ 0x43, 0xbf, 0xf3, 0xae, 0x9c, 0x98, 0x2a, 0x6c, 0x2e,
+ 0x34, 0x27, 0x5c, 0x4b, 0xd7, 0x5a, 0x74, 0xf4, 0xf4,
+ 0x4e, 0x63, 0x83, 0xef, 0x2d, 0xc5, 0x15, 0x2a, 0xd0,
+ 0x7b, 0x3c, 0xf9, 0x2e, 0xcb, 0x0f, 0x8f, 0x48, 0x29,
+ 0x1f, 0xe3, 0xc4, 0xac, 0x65, 0xbd, 0xcb, 0xbb, 0xb1,
+ 0xf0, 0x45, 0x6e, 0x6c, 0x38, 0xbf, 0x5d, 0x50, 0xef,
+ 0xb2, 0xd9, 0x62, 0x13, 0x92, 0x6f, 0xa7, 0x4a, 0x24,
+ 0x83, 0x1e, 0x25, 0x40, 0x4a, 0x4e, 0x1c, 0x90, 0xf2,
+ 0x5f, 0x6c, 0x8a, 0xe0, 0x4f, 0xdc, 0xc1, 0x2d, 0x8d,
+ 0x15, 0x95, 0xdf, 0x0f, 0x1b, 0xce, 0x28, 0xce, 0x2f,
+ 0xcf, 0x13, 0xb2, 0xe5,
+ ],
+ dp = [
+ 0x02, 0x49, 0x8c, 0xb8, 0xe3, 0x23, 0x13, 0x4b, 0xac,
+ 0xb0, 0x07, 0xb6, 0x02, 0xf3, 0xfb, 0x13, 0x3d, 0x03,
+ 0xfb, 0xaa, 0x3d, 0x44, 0xf1, 0x40, 0x3e, 0x46, 0x3d,
+ 0xb1, 0xf1, 0x6e, 0x46, 0x7f, 0x81, 0x02, 0x8f, 0x0e,
+ 0x5a, 0xe4, 0x99, 0x35, 0x59, 0xd4, 0x68, 0xf1, 0x2c,
+ 0xaf, 0xac, 0x7c, 0x08, 0x40, 0x6c, 0xa5, 0x51, 0x01,
+ 0xe9, 0xbe, 0xc7, 0x73, 0xb2, 0x5d, 0xf6, 0x84, 0x66,
+ 0x32, 0x4c, 0xdd, 0x88, 0x65, 0x1d, 0xb4, 0x82, 0x60,
+ 0x51, 0xd9, 0xcb, 0x3a, 0x1e, 0x36, 0x3a, 0x60, 0x5e,
+ 0xb4, 0x47, 0x1c, 0xe8, 0xeb, 0x9e, 0x99, 0xbc, 0xf9,
+ 0x45, 0x8a, 0x09, 0xd9, 0xbe, 0xf6, 0x1c, 0x4e, 0x8f,
+ 0xbf, 0x65, 0x49, 0xbe, 0x9b, 0xfc, 0x65, 0x89, 0xad,
+ 0x58, 0x82, 0x51, 0x75, 0xc8, 0xa0, 0xb4, 0x91, 0x6c,
+ 0x24, 0xac, 0xb5, 0x29, 0x0d, 0x72, 0x43, 0x4c, 0xab,
+ 0x91, 0x02, 0xcc, 0x5a, 0x8c, 0x4c, 0x47, 0xe6, 0x44,
+ 0x41, 0xdc, 0xec, 0x49, 0xb4, 0x68, 0x84, 0xbe, 0x89,
+ 0x39, 0xe1, 0xe5, 0xb3, 0x73, 0x7e, 0xde, 0xde, 0xfe,
+ 0x66, 0x29, 0xa8, 0x2a, 0x77, 0x3a, 0xba, 0xcc, 0x49,
+ 0xc2, 0x3d, 0x10, 0x10, 0x5a, 0x98, 0xe7, 0x14, 0x7b,
+ 0xf3, 0xd6, 0xe5, 0xb6, 0xdb, 0xf4, 0x9b, 0x4b, 0x89,
+ 0xd3, 0xde, 0xf5, 0x55, 0x1c, 0x9e, 0x05, 0xde, 0x7f,
+ 0xf7, 0x23, 0x6d,
+ ],
+ dq = [
+ 0x2d, 0x13, 0x96, 0x18, 0x29, 0xf1, 0x5b, 0x97, 0xc4,
+ 0xe7, 0x48, 0x23, 0x05, 0xbd, 0xb5, 0x81, 0x5e, 0x59,
+ 0x2e, 0x50, 0x81, 0x64, 0x9e, 0x38, 0x11, 0x09, 0xfe,
+ 0xbf, 0x32, 0x93, 0x7e, 0x64, 0x10, 0x7f, 0xb0, 0x7c,
+ 0xa1, 0xa8, 0x3c, 0xc7, 0xb0, 0x0c, 0x96, 0x12, 0x31,
+ 0xb6, 0x55, 0x0a, 0x06, 0x21, 0x21, 0xf3, 0x38, 0x6d,
+ 0x68, 0x54, 0xfa, 0x15, 0x9f, 0x46, 0xc6, 0x46, 0xa1,
+ 0x29, 0x52, 0xd9, 0xbd, 0xf6, 0xc9, 0x01, 0x87, 0x04,
+ 0x6d, 0xe8, 0x63, 0x7b, 0x34, 0x87, 0x16, 0x9a, 0x5f,
+ 0x7e, 0x1c, 0x6f, 0x2f, 0xe9, 0x57, 0xb6, 0x91, 0xb7,
+ 0x78, 0xb0, 0x57, 0x51, 0x91, 0x72, 0x39, 0xd7, 0x14,
+ 0xa9, 0x28, 0x60, 0xfe, 0x02, 0x1e, 0xa7, 0x10, 0xeb,
+ 0x75, 0xd9, 0x27, 0x84, 0xd2, 0x1a, 0x7e, 0x3a, 0xb5,
+ 0xd5, 0x86, 0xaa, 0xa5, 0x37, 0xb2, 0x2c, 0xa5, 0x0b,
+ 0x98, 0x78, 0x24, 0xf2, 0x86, 0x1f, 0x16, 0x48, 0xb0,
+ 0x87, 0xeb, 0xe6, 0x8b, 0x43, 0xc7, 0x87, 0xab, 0xd8,
+ 0xd3, 0xe5, 0x64, 0x54, 0x49, 0x54, 0xb8, 0x2f, 0xc8,
+ 0x47, 0x47, 0x21, 0xa5, 0xa4, 0x0b, 0x83, 0xf1, 0x9b,
+ 0x06, 0xd0, 0x65, 0xf0, 0xf1, 0x7d, 0x1f, 0x2e, 0x6a,
+ 0x04, 0xe2, 0x10, 0x3f, 0xa3, 0x56, 0x2a, 0x64, 0xfd,
+ 0xa4, 0xbb, 0xb2, 0xe6, 0xd8, 0xdc, 0xa9, 0xa2, 0x3e,
+ 0xf8, 0x2e, 0x49,
+ ],
+ iq = [
+ 0x66, 0x80, 0xb0, 0x0c, 0xd2, 0x08, 0xc1, 0x5f, 0x8c,
+ 0x33, 0xb9, 0xa0, 0x1b, 0x0d, 0xb4, 0xd3, 0x00, 0x3d,
+ 0xda, 0xd7, 0x46, 0xb4, 0xab, 0xc8, 0xa7, 0x8a, 0xe1,
+ 0x06, 0x07, 0x5e, 0x34, 0xb2, 0xb3, 0x88, 0x6f, 0xb9,
+ 0x3d, 0x51, 0x0d, 0x23, 0x9f, 0xa0, 0x65, 0x87, 0x41,
+ 0x5e, 0x7d, 0xb0, 0x4c, 0xbf, 0xc5, 0xfc, 0x18, 0xbc,
+ 0x22, 0xd6, 0xae, 0x95, 0xee, 0xad, 0x14, 0xe0, 0x75,
+ 0xcc, 0x6e, 0xfa, 0xa0, 0xe6, 0x21, 0xd3, 0x1d, 0x1b,
+ 0x8c, 0xda, 0x4d, 0x24, 0xcc, 0x1e, 0xd9, 0x94, 0x72,
+ 0xb6, 0x2e, 0xe0, 0x5c, 0xc4, 0x4e, 0x84, 0xfe, 0xe9,
+ 0xe2, 0x8c, 0xf0, 0x98, 0x07, 0xc3, 0x82, 0x2c, 0xfc,
+ 0xbe, 0x9e, 0xb5, 0x77, 0xdb, 0x94, 0xf9, 0xc6, 0x84,
+ 0xdf, 0x36, 0x6f, 0xfe, 0x62, 0x91, 0xda, 0x5b, 0xe2,
+ 0x6e, 0x73, 0x4d, 0x3b, 0x7a, 0x84, 0xc6, 0x69, 0xb7,
+ 0x04, 0x6d, 0x1e, 0xa1, 0x7d, 0x5b, 0x50, 0xd9, 0x1b,
+ 0xda, 0xb4, 0x67, 0xb7, 0x9c, 0x15, 0x49, 0x8b, 0x53,
+ 0xd2, 0x11, 0xe8, 0x8d, 0x96, 0x96, 0x8f, 0x0b, 0xe2,
+ 0x4b, 0x7d, 0xca, 0x4a, 0x1e, 0x7f, 0xb2, 0x1c, 0x42,
+ 0x10, 0x1f, 0x68, 0x1d, 0x7c, 0x47, 0xe3, 0xd6, 0x11,
+ 0x4a, 0x2d, 0x81, 0xfe, 0xf0, 0x1d, 0xd6, 0x8c, 0xd5,
+ 0xb0, 0x42, 0x0b, 0x65, 0x4b, 0x18, 0xd9, 0x12, 0x22,
+ 0xbd, 0x0f, 0x88,
+ ],
+ ...
+ },
+ ...
+};
+
+let enc4096: keypair = keypair {
+ pub = pubparams {
+ n = [
+ 0x00, 0xaf, 0xa5, 0xc5, 0xc6, 0x39, 0x74, 0xc1, 0x5b,
+ 0x85, 0xba, 0xc9, 0x66, 0x2e, 0x44, 0x9f, 0xd8, 0x75,
+ 0xbc, 0x14, 0x4e, 0x8b, 0x93, 0x09, 0xa9, 0x32, 0x32,
+ 0x06, 0xcc, 0x33, 0x40, 0x5f, 0xd1, 0x68, 0xc6, 0x00,
+ 0x6f, 0xa4, 0xe4, 0xe0, 0x3d, 0xde, 0x7e, 0xed, 0x87,
+ 0xeb, 0x7e, 0x42, 0xd4, 0xe1, 0xa6, 0xab, 0xfc, 0xf4,
+ 0xf3, 0x47, 0x46, 0x7d, 0x1c, 0x05, 0x62, 0xaa, 0x6e,
+ 0x5f, 0x61, 0xe7, 0xca, 0x48, 0xf6, 0xb9, 0x70, 0x23,
+ 0x9d, 0x50, 0xe3, 0x7d, 0x00, 0x19, 0x78, 0x32, 0xb2,
+ 0x05, 0x4b, 0xe1, 0x99, 0x6f, 0x1f, 0x57, 0x98, 0x2a,
+ 0x58, 0x53, 0x45, 0xc8, 0x44, 0x59, 0x68, 0xf2, 0x22,
+ 0xc4, 0x4e, 0x0e, 0xff, 0xcd, 0x2b, 0x9a, 0x1a, 0x39,
+ 0xd0, 0x77, 0xff, 0x7c, 0x62, 0x04, 0xc9, 0xb3, 0xfc,
+ 0xff, 0x66, 0x38, 0x6e, 0x54, 0xc4, 0xa7, 0x56, 0xa2,
+ 0xf0, 0xab, 0xdf, 0x18, 0x98, 0xd9, 0x6a, 0x12, 0x64,
+ 0xa0, 0xff, 0x96, 0x89, 0x52, 0x4d, 0xc0, 0x3a, 0x33,
+ 0x07, 0x73, 0x83, 0x42, 0xd3, 0x30, 0x86, 0xba, 0x29,
+ 0x69, 0x6b, 0x65, 0x14, 0x93, 0xf5, 0x61, 0xea, 0x40,
+ 0x28, 0xa2, 0xcb, 0xa2, 0x0c, 0xa4, 0x47, 0x52, 0x40,
+ 0x05, 0x95, 0xc4, 0x4a, 0x1d, 0x2c, 0x93, 0x5a, 0x67,
+ 0x31, 0xac, 0x95, 0x42, 0x2e, 0x9c, 0x07, 0x22, 0x6a,
+ 0xaa, 0x60, 0x38, 0x8e, 0xab, 0x97, 0x09, 0x0a, 0x63,
+ 0x43, 0x57, 0x0b, 0x58, 0x02, 0x55, 0x3d, 0x78, 0xba,
+ 0xcb, 0x80, 0x29, 0x84, 0xc3, 0xd2, 0x08, 0x8a, 0xce,
+ 0xc5, 0x41, 0x04, 0x85, 0x6d, 0xad, 0xbb, 0x30, 0x09,
+ 0x32, 0x8b, 0x32, 0x95, 0xcb, 0xd6, 0x9c, 0x2a, 0xfc,
+ 0x52, 0x5e, 0xf8, 0xbc, 0x7b, 0x1f, 0x97, 0x09, 0xbc,
+ 0x84, 0x67, 0xf3, 0xf4, 0x2d, 0x5c, 0xc5, 0x5b, 0x30,
+ 0xcd, 0x85, 0xee, 0xbc, 0x44, 0xd1, 0x45, 0x09, 0x9f,
+ 0xa2, 0x62, 0xf6, 0x2b, 0xe9, 0xe1, 0x4e, 0x08, 0x3d,
+ 0xf7, 0x78, 0xd8, 0x4e, 0x6e, 0xec, 0x87, 0x0a, 0x9d,
+ 0x6d, 0x17, 0x33, 0xa2, 0x9a, 0x28, 0x10, 0x42, 0xfc,
+ 0x34, 0xd7, 0x86, 0x4c, 0x21, 0x97, 0x9e, 0xae, 0xe4,
+ 0x36, 0x6e, 0xd2, 0xdf, 0x4f, 0xe8, 0xd6, 0xcc, 0xd7,
+ 0x82, 0xb9, 0xb0, 0x6e, 0x8c, 0x19, 0x08, 0xa5, 0xca,
+ 0x44, 0x47, 0x52, 0x83, 0x26, 0x66, 0xe8, 0x54, 0x18,
+ 0x80, 0x11, 0x69, 0x11, 0x4e, 0x00, 0x59, 0xf2, 0x62,
+ 0x9b, 0x57, 0x87, 0xb3, 0x87, 0xd3, 0x17, 0xaf, 0x87,
+ 0x20, 0xeb, 0x90, 0x7f, 0x19, 0xd9, 0x3f, 0xee, 0x98,
+ 0xe6, 0xcf, 0x26, 0x1f, 0x20, 0xef, 0xf6, 0x77, 0x5b,
+ 0xc7, 0x01, 0x89, 0x8b, 0x77, 0xf9, 0x13, 0x89, 0xfb,
+ 0x9d, 0xb8, 0x3f, 0x82, 0x05, 0x66, 0xa9, 0xd9, 0x72,
+ 0x66, 0x2c, 0xda, 0x19, 0x56, 0x18, 0x1e, 0xf8, 0x12,
+ 0x1f, 0x61, 0x8b, 0xa9, 0x6e, 0x75, 0x0e, 0x40, 0x33,
+ 0xfd, 0xde, 0x70, 0x62, 0xc2, 0x0a, 0x30, 0x0c, 0x46,
+ 0x8f, 0x22, 0xc9, 0x15, 0x31, 0x6c, 0xc8, 0xfd, 0xdd,
+ 0xc5, 0x9e, 0x6b, 0x41, 0x46, 0x9f, 0x32, 0xac, 0x3d,
+ 0xc4, 0xd6, 0x61, 0x80, 0x8e, 0x12, 0x3b, 0x7c, 0xb2,
+ 0xda, 0x07, 0x80, 0xd8, 0xf5, 0x07, 0xcd, 0xe6, 0x74,
+ 0x9d, 0x4f, 0x09, 0x54, 0x24, 0x3d, 0x02, 0xf8, 0x96,
+ 0x10, 0x58, 0x4f, 0x78, 0x30, 0xbc, 0x98, 0x01, 0xf6,
+ 0xa3, 0x80, 0x58, 0x64, 0x07, 0x50, 0x5d, 0x06, 0x1e,
+ 0xe9, 0x77, 0xf5, 0x65, 0xe5, 0x90, 0xf9, 0x63, 0x73,
+ 0x9f, 0xd3, 0x9d, 0xc7, 0xba, 0xc1, 0x79, 0x28, 0x7f,
+ 0xfd, 0xce, 0x28, 0x84, 0xb8, 0x49, 0x78, 0x9b, 0xb4,
+ 0x6e, 0x7b, 0xe5, 0xeb, 0x1d, 0x9f, 0xc8, 0x63, 0xd5,
+ 0x99, 0x05, 0x2d, 0x73, 0x8e, 0xe1, 0x32, 0xaa, 0x2d,
+ ],
+ e = [0x10, 0x00, 0x01],
+ ...
+ },
+ priv = privparams {
+ nbitlen = 4096,
+ p = [
+ 0x00, 0xd9, 0x34, 0x08, 0x8a, 0x7c, 0x2f, 0xe7, 0x38,
+ 0x7d, 0x7e, 0xc9, 0x30, 0xb5, 0x05, 0x2b, 0x5f, 0x93,
+ 0xd3, 0xf8, 0xee, 0x13, 0x2a, 0x81, 0xec, 0x6d, 0x69,
+ 0x35, 0x8b, 0x7c, 0x92, 0x0b, 0xae, 0x5b, 0x8d, 0x4c,
+ 0x8d, 0x0c, 0x08, 0x77, 0x39, 0xf0, 0xde, 0x2b, 0x9e,
+ 0x48, 0x87, 0xc4, 0x2f, 0x15, 0x80, 0x30, 0x94, 0x18,
+ 0xfe, 0x72, 0x5e, 0x3d, 0x6b, 0x82, 0x29, 0xca, 0xd6,
+ 0xe7, 0xa5, 0x7e, 0x8b, 0x26, 0x23, 0xee, 0x2e, 0x6d,
+ 0xe8, 0x00, 0x53, 0x1a, 0xaa, 0x9c, 0x2f, 0xc7, 0xfb,
+ 0xab, 0x10, 0x3d, 0xb9, 0x84, 0x15, 0x73, 0xbb, 0x18,
+ 0xfe, 0x45, 0xa7, 0x70, 0x74, 0xdc, 0x9e, 0x39, 0xe6,
+ 0x61, 0xa9, 0x6a, 0x06, 0xb3, 0xa5, 0x35, 0x57, 0x3b,
+ 0x7b, 0xa9, 0xb7, 0xe1, 0xd7, 0x56, 0x00, 0xa9, 0x03,
+ 0xd8, 0x33, 0xe4, 0x5a, 0x76, 0x4f, 0x8f, 0x14, 0xcc,
+ 0xe2, 0xf2, 0xf7, 0xf0, 0x10, 0x3f, 0xd4, 0x5d, 0x02,
+ 0x49, 0xb7, 0xf8, 0x47, 0x32, 0x4c, 0x13, 0x6c, 0xfb,
+ 0xf5, 0xf5, 0x8a, 0x43, 0xcb, 0xa7, 0xb4, 0x8d, 0xd5,
+ 0x11, 0x39, 0x99, 0x1b, 0xe1, 0x81, 0x0b, 0x1b, 0x4e,
+ 0x1f, 0x15, 0xf9, 0x60, 0x98, 0x5c, 0x0a, 0x89, 0x72,
+ 0x2b, 0x25, 0xfb, 0x11, 0xfb, 0x8f, 0x4f, 0x21, 0x3c,
+ 0x3a, 0xe9, 0xd1, 0xca, 0x36, 0x64, 0xaf, 0xbf, 0xac,
+ 0x5e, 0xee, 0x92, 0x98, 0xa6, 0xd0, 0x4d, 0x74, 0x1d,
+ 0x68, 0xfe, 0x84, 0xd4, 0x8d, 0xa8, 0x44, 0xac, 0x63,
+ 0xf7, 0xbb, 0x9c, 0xaa, 0x65, 0x3a, 0xe9, 0x4b, 0x12,
+ 0xb8, 0x28, 0xbf, 0xf1, 0x58, 0x44, 0x32, 0xe6, 0x59,
+ 0x10, 0xb5, 0x5d, 0xd0, 0x03, 0xf7, 0x8d, 0x42, 0xcc,
+ 0x61, 0x24, 0xe1, 0xf1, 0x2f, 0x7a, 0x4b, 0xf6, 0x97,
+ 0x1e, 0x75, 0xa1, 0xec, 0xd9, 0x0b, 0x64, 0x46, 0xae,
+ 0x67, 0x5b, 0x7d, 0xc5, 0x63,
+ ],
+ q = [
+ 0x00, 0xcf, 0x05, 0x89, 0xb9, 0x51, 0x83, 0xd3, 0xab,
+ 0xed, 0xe4, 0x61, 0x35, 0x3c, 0x48, 0xbe, 0xb6, 0x15,
+ 0x87, 0x4e, 0xab, 0x18, 0xef, 0x23, 0x6d, 0x37, 0xcf,
+ 0x39, 0xe7, 0x64, 0x4e, 0x58, 0xaa, 0xe9, 0x3a, 0xb5,
+ 0x23, 0x45, 0xc9, 0xe5, 0x4f, 0xad, 0xa9, 0x10, 0x30,
+ 0xdf, 0x5d, 0x06, 0x20, 0x16, 0xc6, 0x5e, 0x2a, 0x49,
+ 0xbd, 0x2d, 0x14, 0xe3, 0x32, 0x96, 0xfa, 0x50, 0x5d,
+ 0xfc, 0x9b, 0x44, 0x60, 0xa7, 0x36, 0x59, 0x62, 0xe9,
+ 0xba, 0x8e, 0x15, 0x5b, 0x52, 0xd3, 0x6d, 0x84, 0x02,
+ 0x90, 0x0d, 0xee, 0xb8, 0x60, 0x7b, 0x68, 0x80, 0x1f,
+ 0xf2, 0xe2, 0x2a, 0xe3, 0x9a, 0xfb, 0x0d, 0x97, 0xae,
+ 0x34, 0x65, 0x32, 0xfd, 0x13, 0xf2, 0x77, 0xfd, 0x21,
+ 0x79, 0x48, 0x39, 0xb3, 0xd4, 0x19, 0x29, 0x0c, 0x42,
+ 0xcb, 0xd5, 0x6a, 0x6c, 0xed, 0x48, 0xfa, 0x54, 0x83,
+ 0x16, 0x04, 0x73, 0xd6, 0xbc, 0xb2, 0xc9, 0xb2, 0xd4,
+ 0x6b, 0xbb, 0x5f, 0xb1, 0x69, 0xd3, 0x51, 0x3c, 0x29,
+ 0x77, 0xba, 0xcf, 0x83, 0xc4, 0xe7, 0x84, 0xf6, 0x0c,
+ 0xdc, 0xfa, 0x55, 0x1b, 0xa3, 0xb4, 0xa1, 0xc0, 0x8a,
+ 0x61, 0xfa, 0x79, 0x1b, 0x82, 0xb3, 0xb0, 0xaa, 0xc0,
+ 0xed, 0xe2, 0xf9, 0x69, 0x1c, 0x8a, 0x17, 0x56, 0xa9,
+ 0xc1, 0xbb, 0x86, 0xe7, 0xff, 0xfe, 0x71, 0xcc, 0xa2,
+ 0xea, 0xe4, 0x92, 0x8b, 0xed, 0xcc, 0x3e, 0x10, 0xd6,
+ 0x4a, 0x53, 0xea, 0xdf, 0x53, 0xf5, 0x0c, 0x2b, 0x7d,
+ 0x84, 0x54, 0x6e, 0xac, 0xb8, 0x57, 0x1e, 0xd3, 0x8c,
+ 0xc4, 0x92, 0xae, 0x6a, 0x1d, 0x6f, 0x1d, 0x44, 0xfe,
+ 0xc8, 0x61, 0xf8, 0x4e, 0xd9, 0xc6, 0x61, 0xef, 0xc9,
+ 0x5d, 0xc1, 0xc6, 0x64, 0xfa, 0x42, 0xf5, 0x46, 0x39,
+ 0x6e, 0xa0, 0x7a, 0x70, 0xb2, 0x20, 0xbc, 0x1e, 0xf8,
+ 0xb4, 0x91, 0x1c, 0xef, 0x2f,
+ ],
+ dp = [
+ 0x4f, 0xcd, 0x85, 0x61, 0xd4, 0x55, 0x09, 0x60, 0x41,
+ 0x03, 0xa7, 0x4a, 0x05, 0x08, 0x7c, 0x32, 0x26, 0xaf,
+ 0x58, 0x23, 0xa8, 0xd9, 0x12, 0x59, 0x5a, 0xad, 0xb0,
+ 0x25, 0xaa, 0xc4, 0x42, 0x14, 0x72, 0xc0, 0xcc, 0xa2,
+ 0x7a, 0x0c, 0x56, 0x39, 0xec, 0x9c, 0xc4, 0x6b, 0xe8,
+ 0x7c, 0x31, 0x81, 0x97, 0x25, 0xbd, 0x33, 0x7c, 0xa7,
+ 0x68, 0x3f, 0xe5, 0xd3, 0x2d, 0x44, 0xcb, 0xa8, 0xff,
+ 0xfd, 0x57, 0x2c, 0x2a, 0xfc, 0x42, 0x93, 0xbe, 0x7f,
+ 0xe2, 0x36, 0xa6, 0x72, 0x8e, 0xe6, 0x23, 0x54, 0xfd,
+ 0x39, 0xff, 0x63, 0xbc, 0xfa, 0xe0, 0xc5, 0x9a, 0x5e,
+ 0x3a, 0x1b, 0x55, 0xff, 0x29, 0xdb, 0xdc, 0xac, 0x1f,
+ 0xaf, 0xce, 0x2b, 0xde, 0x2f, 0x52, 0x14, 0xd5, 0xdf,
+ 0x0e, 0xb1, 0x68, 0x01, 0xe5, 0x30, 0x62, 0xe8, 0xed,
+ 0xb3, 0xcb, 0x2f, 0xcd, 0x8e, 0x57, 0xa4, 0xad, 0xce,
+ 0xa8, 0xb4, 0x9d, 0xf8, 0x6a, 0x6b, 0x4d, 0x2c, 0xfd,
+ 0x06, 0xe1, 0xea, 0xce, 0xb9, 0x12, 0xde, 0x15, 0x08,
+ 0xfe, 0x89, 0x29, 0x75, 0x97, 0x0d, 0x88, 0x9b, 0x03,
+ 0x34, 0x25, 0x64, 0x10, 0x0b, 0x88, 0x98, 0x24, 0xb0,
+ 0xd9, 0x33, 0x01, 0xe1, 0x98, 0xd7, 0xaa, 0x3e, 0x4f,
+ 0x4a, 0x2a, 0x20, 0x26, 0x4c, 0x36, 0x27, 0xa0, 0xe8,
+ 0x88, 0x66, 0x33, 0x24, 0x9f, 0x03, 0xcf, 0xa9, 0xb6,
+ 0x4b, 0x73, 0x83, 0x30, 0xaf, 0x11, 0xf6, 0x1a, 0xa4,
+ 0x2b, 0xf7, 0x83, 0xdc, 0xf4, 0x39, 0x1f, 0x19, 0xaf,
+ 0xb8, 0xb7, 0xcc, 0x07, 0x5b, 0x88, 0xc1, 0xb3, 0x84,
+ 0x04, 0x3c, 0xd9, 0xa0, 0xb3, 0x95, 0xfb, 0xfa, 0x37,
+ 0x60, 0x5b, 0xb2, 0x84, 0xf2, 0x9c, 0x6d, 0x31, 0x88,
+ 0x73, 0xb3, 0xac, 0x18, 0xe4, 0x97, 0x2a, 0x67, 0xc5,
+ 0xa2, 0x34, 0xb7, 0x3f, 0xdb, 0xa6, 0xa1, 0x2d, 0x8c,
+ 0xfe, 0x19, 0x8c, 0xbf,
+ ],
+ dq = [
+ 0x00, 0xcb, 0x6c, 0x77, 0xae, 0xa0, 0x08, 0xd7, 0xa0,
+ 0x23, 0xfc, 0xbc, 0x00, 0x61, 0xa2, 0x61, 0xb3, 0xee,
+ 0x67, 0xac, 0xc7, 0xb7, 0x92, 0x94, 0xcf, 0x27, 0x7d,
+ 0xfb, 0x3a, 0x02, 0x78, 0x71, 0xec, 0x4f, 0x8d, 0x9e,
+ 0x9c, 0x70, 0x61, 0x39, 0x71, 0x18, 0x05, 0xfe, 0xa0,
+ 0xe7, 0x7b, 0x33, 0x1f, 0xa9, 0x01, 0x77, 0x5a, 0x3a,
+ 0x67, 0x27, 0xbb, 0x54, 0x9d, 0x4b, 0x79, 0xe0, 0x2a,
+ 0xda, 0xa3, 0x7f, 0x87, 0x32, 0x07, 0xd7, 0xc1, 0xb8,
+ 0x45, 0xd6, 0x83, 0xe9, 0xde, 0xf3, 0x5e, 0xb3, 0xcf,
+ 0x08, 0xda, 0x87, 0xee, 0xa8, 0xef, 0xda, 0xf9, 0xbb,
+ 0x6b, 0x21, 0x0e, 0x5f, 0xe4, 0xd4, 0x38, 0xc1, 0x09,
+ 0x2e, 0xf7, 0x1a, 0x29, 0x50, 0xc6, 0x7b, 0x5d, 0x42,
+ 0xdd, 0x38, 0x39, 0x6b, 0x19, 0x49, 0x37, 0xea, 0x92,
+ 0x60, 0x54, 0xef, 0x64, 0xe5, 0xad, 0x46, 0x3e, 0x71,
+ 0x28, 0xdb, 0x6b, 0x30, 0x60, 0xef, 0x95, 0xfe, 0xa1,
+ 0x78, 0xd2, 0xff, 0xef, 0x07, 0x3b, 0xdc, 0xa1, 0x2f,
+ 0x66, 0x35, 0x2c, 0xe0, 0x20, 0x46, 0x17, 0x82, 0xe7,
+ 0x94, 0xe4, 0x6f, 0x68, 0xdf, 0x6e, 0x09, 0x5b, 0x77,
+ 0x1f, 0x5b, 0xce, 0x51, 0x58, 0x17, 0x55, 0xcc, 0x14,
+ 0x14, 0x2d, 0x6a, 0x42, 0xfd, 0x06, 0x3c, 0x74, 0xae,
+ 0x0e, 0x6e, 0x44, 0xdc, 0x07, 0xd2, 0x70, 0xe4, 0x52,
+ 0x5a, 0x5a, 0x0c, 0x1e, 0x6f, 0xa6, 0xb8, 0x7e, 0x36,
+ 0xf3, 0x86, 0x8e, 0x4e, 0xb0, 0xe3, 0x23, 0xf8, 0x40,
+ 0x38, 0x1d, 0xf7, 0x3a, 0xc5, 0x50, 0xe6, 0x3b, 0x9e,
+ 0x21, 0x32, 0xb9, 0x2c, 0x10, 0x8c, 0x34, 0xc8, 0xad,
+ 0x4b, 0x1d, 0xe9, 0xaf, 0x21, 0x93, 0x2c, 0x7d, 0x40,
+ 0xf3, 0x5e, 0x0b, 0xa3, 0x01, 0xbf, 0x75, 0xe0, 0x71,
+ 0x62, 0xe1, 0x52, 0x2f, 0x16, 0xf9, 0xcf, 0xa0, 0xe7,
+ 0x66, 0x17, 0x09, 0xc5, 0x85,
+ ],
+ iq = [
+ 0x00, 0xcc, 0x1c, 0x14, 0x9c, 0x4f, 0x16, 0xa4, 0x5c,
+ 0x14, 0x37, 0x53, 0xde, 0xf7, 0xf4, 0x74, 0x76, 0xc8,
+ 0xb1, 0x62, 0x49, 0x42, 0xcf, 0xbf, 0x65, 0xe5, 0x8f,
+ 0x4c, 0xb6, 0x7d, 0x59, 0x41, 0x87, 0x32, 0x8c, 0x9b,
+ 0x9f, 0x96, 0x9e, 0xb1, 0xf0, 0x2e, 0x4b, 0xa2, 0xc2,
+ 0xab, 0x01, 0x19, 0x19, 0x6c, 0x79, 0x01, 0xc8, 0x52,
+ 0xff, 0xd4, 0xbd, 0xd8, 0xba, 0xeb, 0xc1, 0x70, 0xea,
+ 0xfb, 0x37, 0x31, 0x79, 0x16, 0xe0, 0x78, 0x79, 0xaf,
+ 0x41, 0x37, 0xaa, 0x4e, 0x2c, 0xdc, 0x1d, 0x1b, 0xdc,
+ 0x44, 0x1e, 0x03, 0x2e, 0xd0, 0x17, 0x25, 0x23, 0x67,
+ 0xd2, 0x7b, 0xea, 0xc2, 0x91, 0xb7, 0x9a, 0x31, 0xa5,
+ 0xff, 0xbd, 0x36, 0x07, 0xae, 0xd7, 0xec, 0x05, 0xb9,
+ 0x05, 0x31, 0x16, 0xc4, 0x29, 0xf9, 0x23, 0x0c, 0x6d,
+ 0x2e, 0xc3, 0x0b, 0x6a, 0xc9, 0xe2, 0xab, 0x8b, 0x05,
+ 0x8b, 0xb4, 0xc2, 0x4d, 0xbf, 0xa7, 0x6b, 0xa4, 0x00,
+ 0x23, 0x82, 0xb4, 0xfa, 0x8d, 0xcf, 0x0d, 0x31, 0x8e,
+ 0xd6, 0xbc, 0xc2, 0x15, 0xae, 0x8c, 0xa7, 0x0f, 0xd0,
+ 0xf4, 0x5b, 0x87, 0x6a, 0xd0, 0x9f, 0xa5, 0xb4, 0x5c,
+ 0xd7, 0xbf, 0xca, 0x40, 0x82, 0x44, 0x00, 0xf9, 0xda,
+ 0x06, 0x4e, 0x8c, 0x48, 0x8f, 0x11, 0xf3, 0x64, 0x05,
+ 0x55, 0x8d, 0xfb, 0x39, 0xf8, 0x91, 0x8a, 0x83, 0xd6,
+ 0x73, 0x05, 0x1f, 0x4c, 0xed, 0x47, 0x96, 0xf5, 0x73,
+ 0xe8, 0xf9, 0xb3, 0xeb, 0x91, 0xe4, 0xea, 0x0e, 0xb8,
+ 0xd5, 0xa8, 0xf2, 0x60, 0xcc, 0x05, 0x5b, 0x1d, 0x9b,
+ 0xe5, 0xe4, 0xe5, 0x36, 0x0b, 0x2b, 0xc0, 0xd2, 0x1c,
+ 0x55, 0xd6, 0x68, 0xb6, 0xd8, 0x56, 0x83, 0x80, 0x22,
+ 0x44, 0x34, 0x9b, 0x2b, 0x71, 0xc1, 0x4b, 0xca, 0x36,
+ 0x41, 0x2a, 0x2e, 0xff, 0x23, 0x8b, 0x0a, 0x16, 0x76,
+ 0x56, 0xb6, 0x8e, 0x3b, 0x69,
+ ],
+ ...
+ },
+ d = [
+ 0x54, 0x76, 0xd8, 0x0b, 0x41, 0x77, 0xe6, 0xbf, 0x77, 0x28,
+ 0x62, 0x4e, 0xf3, 0xb2, 0xe6, 0x56, 0xf6, 0x0e, 0xd2, 0x89,
+ 0x0e, 0xcf, 0x4f, 0x57, 0x00, 0x9f, 0x53, 0xeb, 0x80, 0x3d,
+ 0xd5, 0x95, 0xe2, 0xd7, 0x4c, 0x40, 0x63, 0xbf, 0xf8, 0x21,
+ 0x68, 0x4c, 0x0b, 0x37, 0x50, 0x44, 0x30, 0x29, 0x24, 0xb5,
+ 0xbc, 0x80, 0xf0, 0xdd, 0xc8, 0x09, 0x9a, 0x82, 0x0e, 0x08,
+ 0xeb, 0x42, 0x16, 0x36, 0x03, 0x7b, 0x9f, 0xe8, 0x9d, 0x35,
+ 0xd2, 0xba, 0x84, 0xba, 0x50, 0x52, 0xea, 0xec, 0x85, 0x1c,
+ 0x5c, 0x35, 0xa8, 0x2f, 0xdb, 0x62, 0xec, 0x01, 0x6d, 0x63,
+ 0x79, 0xef, 0xd5, 0xa5, 0x20, 0x85, 0xb9, 0xe2, 0x84, 0x19,
+ 0xb1, 0x56, 0xcb, 0x37, 0xcb, 0x6c, 0x0f, 0x1f, 0x33, 0x85,
+ 0x35, 0x30, 0x01, 0x73, 0x69, 0x4d, 0x21, 0x17, 0xeb, 0xcd,
+ 0x0a, 0x90, 0x62, 0x93, 0xe3, 0xd8, 0xee, 0x1d, 0x63, 0x3b,
+ 0xa5, 0x59, 0x3f, 0xad, 0x0a, 0x4a, 0xbd, 0xfe, 0x1d, 0x08,
+ 0xec, 0x86, 0x50, 0x21, 0xa6, 0x27, 0x99, 0xcb, 0xea, 0xca,
+ 0xee, 0xdc, 0x99, 0x28, 0x1e, 0xbc, 0x6d, 0x86, 0x13, 0x66,
+ 0xcd, 0x21, 0x7d, 0x5f, 0x84, 0xf6, 0xa5, 0x4c, 0xf2, 0xbd,
+ 0x7c, 0xb2, 0x0f, 0x69, 0x40, 0x6c, 0x3e, 0x13, 0xbc, 0x0a,
+ 0x04, 0x1e, 0xe6, 0x6b, 0x79, 0x76, 0x68, 0xd3, 0x78, 0x48,
+ 0xbb, 0x09, 0xc8, 0x73, 0xe1, 0xd2, 0x0f, 0xf7, 0xc2, 0xf4,
+ 0xde, 0x86, 0x88, 0xac, 0xfd, 0xd0, 0x7d, 0xa9, 0x8c, 0xcd,
+ 0x9e, 0x48, 0xf2, 0xf8, 0xa5, 0x03, 0xf0, 0x07, 0x17, 0x8e,
+ 0xad, 0x7b, 0x95, 0x56, 0xe6, 0xea, 0x4f, 0x11, 0xff, 0xaa,
+ 0x9d, 0x00, 0x82, 0xc3, 0xad, 0x8d, 0xd9, 0x3d, 0x2f, 0xec,
+ 0xb6, 0xae, 0xe3, 0xd1, 0x05, 0x5c, 0x07, 0x30, 0x54, 0x6b,
+ 0x4c, 0xa5, 0x98, 0x61, 0x3c, 0x40, 0xe3, 0x8c, 0xf3, 0x01,
+ 0xc2, 0xdd, 0xdd, 0x18, 0xbd, 0x38, 0x35, 0x34, 0x87, 0xbf,
+ 0x05, 0xba, 0x8e, 0x1d, 0x4b, 0x33, 0x63, 0xcc, 0x65, 0x11,
+ 0xbf, 0x59, 0x48, 0x5e, 0x46, 0x82, 0x17, 0xda, 0x6b, 0xcf,
+ 0x7c, 0x06, 0xca, 0x74, 0xbd, 0xa9, 0x78, 0xe0, 0xd2, 0x20,
+ 0xdf, 0xcd, 0x4a, 0xa0, 0x67, 0xe6, 0x90, 0x14, 0x43, 0x20,
+ 0x26, 0x47, 0x83, 0x79, 0xc0, 0xe8, 0xb7, 0x60, 0xb7, 0xa8,
+ 0x96, 0x56, 0x77, 0xc4, 0x9d, 0x32, 0x52, 0xc3, 0xa2, 0x10,
+ 0x69, 0x2c, 0x51, 0x81, 0xc5, 0xd2, 0xa2, 0x27, 0x61, 0xf4,
+ 0x0a, 0xa7, 0x51, 0xe8, 0x44, 0xcb, 0xae, 0xbe, 0xb1, 0x10,
+ 0x75, 0xaa, 0x1c, 0xae, 0x5e, 0xa8, 0x8d, 0x16, 0x6a, 0x4c,
+ 0xf4, 0x26, 0x7a, 0xce, 0x61, 0x70, 0xaf, 0x86, 0x9b, 0x4c,
+ 0xca, 0x26, 0x51, 0xe4, 0xcd, 0xb5, 0x7a, 0x4e, 0xe2, 0xe8,
+ 0x8a, 0xbc, 0x70, 0xcc, 0x1a, 0xc6, 0x54, 0x07, 0x51, 0x14,
+ 0xfd, 0x08, 0x58, 0xba, 0x46, 0xca, 0xa2, 0x2e, 0xf0, 0x4c,
+ 0x0e, 0xc3, 0x5d, 0xd9, 0x53, 0x4d, 0xbe, 0x8c, 0x2f, 0x28,
+ 0x38, 0xf4, 0x26, 0x84, 0x59, 0xba, 0x07, 0xbc, 0xf0, 0xaf,
+ 0x74, 0xb6, 0x4b, 0xf6, 0xdc, 0xab, 0x21, 0xbb, 0xab, 0x5c,
+ 0x97, 0x29, 0x48, 0x87, 0x00, 0x27, 0xf7, 0x58, 0xbb, 0x1d,
+ 0xad, 0x66, 0x50, 0x77, 0x33, 0xfc, 0xb2, 0xc2, 0x8f, 0x4c,
+ 0x3b, 0x4f, 0xab, 0xb4, 0x8f, 0x87, 0x00, 0x3d, 0x55, 0xf3,
+ 0x23, 0xce, 0x22, 0xde, 0x74, 0x29, 0x3e, 0xf0, 0xe8, 0x04,
+ 0x14, 0xf7, 0x36, 0xb1, 0x1b, 0xcf, 0xbc, 0x9b, 0x5d, 0x3d,
+ 0x75, 0xfc, 0x15, 0xcb, 0x3d, 0x2d, 0x8f, 0xaf, 0x1e, 0x12,
+ 0xe8, 0xb4, 0x94, 0xac, 0x64, 0x1b, 0x7c, 0x54, 0x1c, 0xeb,
+ 0x47, 0x40, 0xe3, 0x2b, 0x48, 0x3c, 0xd8, 0x10, 0xf3, 0x93,
+ 0xdb, 0x75,
+ ],
+};
+
+@test fn initd() void = {
+ let params = privparams {
+ p = enc4096.priv.p,
+ q = enc4096.priv.q,
+ iq = enc4096.priv.iq,
+ ...
+ };
+
+ let priv: [PRIVKEYSIZE]u8 = [0...];
+ privkey_initd(priv, params, enc4096.d, enc4096.pub.n)!;
+
+ const newparams = privkey_params(priv);
+
+ assert(enc4096.priv.nbitlen == newparams.nbitlen);
+ assert(enc4096.priv.nbitlen == privkey_nbitlen(priv));
+ assert(bytes::equal(ltrim(enc4096.priv.dp), ltrim(newparams.dp)));
+ assert(bytes::equal(ltrim(enc4096.priv.dq), ltrim(newparams.dq)));
+};
diff --git a/crypto/rsa/README b/crypto/rsa/README
@@ -0,0 +1,18 @@
+This module provides RSA signature and encryption schemes defined in PKCS #1.
+The implementation only supports RSA keys with two prime factors. Most of the
+RSA operations in this module require buffers to perform. Buffer sizes are
+provided for keys of a default maximum size of 4096-bits. [[BITSIZE]]
+may be changed with compiler flags to support bigger keys. [[MINBITSIZE]]
+defines the minimum size accordingly.
+
+Public and private keys are stored in byte slices. [[pubkey_init]] is used
+to initialize a public key. [[privkey_init]] or [[privkey_initd]] is used
+to initialize a private key, depending on which parameters are available.
+
+This is a low-level module which implements cryptographic primitives. Direct
+use of cryptographic primitives is not recommended for non-experts, as
+incorrect use of these primitives can easily lead to the introduction of
+security vulnerabilities. Non-experts are advised to use the high-level
+operations available in the top-level [[crypto]] module.
+
+Be advised that Hare's cryptography implementations have not been audited.
diff --git a/crypto/rsa/core.ha b/crypto/rsa/core.ha
@@ -0,0 +1,229 @@
+// The following code was initially ported from BearSSL.
+//
+// Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+// BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+use bytes;
+use crypto::math::{divu32};
+use crypto::bigint::*;
+use errors;
+use types;
+
+// Maximum factor size of a key of [[BITSIZE]].
+def MAXFACTOR: size = ((BITSIZE + 64) >> 1);
+
+// Required buf size for the [[pubexp]] operation.
+def PUBEXP_BUFSIZE: size = size(word) * (1 + (4 * (2
+ + ((BITSIZE + WORD_BITSIZE - 1) / WORD_BITSIZE))));
+
+// Requried buf size for the [[privexp]] operation.
+def PRIVEXP_BUFSIZE: size = size(word) * (1 + (8 * (2
+ + ((MAXFACTOR + WORD_BITSIZE - 1) / WORD_BITSIZE))));
+
+// Performs the modular exponentiation of 'x' with the public exponent of 'pub'.
+// 'x' is modified in place. 'x' must be the same length as the actual length
+// of 'pub.n'.
+//
+// For the size of 'buf' see [[PUBEXP_BUFSIZE]]. If the buffer is not large
+// enough, [[errors::overflow]] will be returned. In case of 'x' being not of
+// required length or if 'x' is not modulo 'pub.n' [[errors::invalid]] is
+// returned and 'x' will be zeroed.
+fn pubexp(pub: *pubparams, x: []u8, buf: []u8) (void | error) = {
+ // supported key length leaks. But that is not a problem.
+ const wbuflen = len(buf) / size(word);
+ let wbuf: []word = (buf: *[*]word)[..wbuflen];
+ let n = pub.n;
+
+ // get the maximal allowed key size for given buffer. Reverse of the
+ // [[PUBEXP_BUFSIZE]] equation.
+ const maxkeybits = (((wbuflen - 1) / 4) - 2) * WORD_BITSIZE;
+
+ if (len(n) == 0 || len(n) > (maxkeybits >> 3)) {
+ return errors::overflow;
+ };
+
+ if (len(x) != len(n)) {
+ bytes::zero(x);
+ return errors::invalid;
+ };
+
+ // add word size - 1 to ceil required words in the division that follows
+ const maxnbitlen = (len(n) << 3) + WORD_BITSIZE: size - 1;
+ assert(maxnbitlen <= types::U32_MAX);
+ let bwordlen = 1 + divu32(0, maxnbitlen: u32, WORD_BITSIZE).0;
+
+ // make it even
+ bwordlen += bwordlen & 1;
+
+ let nenc = wbuf[..bwordlen];
+ let xenc = wbuf[bwordlen..2 * bwordlen];
+ let t = wbuf[2 * bwordlen..];
+
+ // From now on, buf will be indirectly used via slices borrowed from
+ // wbuf. Therefore make sure it gets cleared in the end.
+ defer bytes::zero(buf);
+
+ encode(nenc, n);
+ const n0i = ninv(nenc[1]);
+
+ // if m is odd, n0i is also.
+ let result: word = n0i & 1;
+ result &= encodemod(xenc, x, nenc);
+
+ modpow(xenc, pub.e, nenc, n0i, t);
+
+ decode(x, xenc);
+
+ if (result == 0: word) {
+ bytes::zero(x);
+ return errors::invalid;
+ };
+};
+
+// Performs modular exponentiation of 'x' with the private exponent of 'priv'.
+// 'x' is modified in place. 'x' must be the same length as the actual length
+// of the modulus n (see [[privkey_nsize]]).
+//
+// For size of 'buf' see [[PRIVEXP_BUFSIZE]]. If the buffer is not large enough
+// [[errors::overflow]] will be returned. In case of an invalid size of 'x' or
+// an invalid key, [[errors::invalid]] will be returned and 'x' will be zeroed.
+fn privexp(priv: *privparams, x: []u8, buf: []u8) (void | error) = {
+ // supported key length leaks. But that is not a problem.
+ const wbuflen = len(buf) / size(word);
+ let wbuf: []word = (buf: *[*]word)[..wbuflen];
+
+ let p = priv.p;
+ let q = priv.q;
+
+ const maxflen = if (len(p) > len(q)) len(p) else len(q);
+
+ // add word size - 1 to ceil required words in the division that follows
+ const maxfbitlen = (maxflen << 3) + WORD_BITSIZE: size - 1;
+ assert(maxfbitlen <= types::U32_MAX);
+ let bwordlen = 1 + divu32(0, maxfbitlen: u32, WORD_BITSIZE).0;
+
+ // make it even
+ bwordlen += bwordlen & 1;
+
+ // We need at least 6 big integers for the following calculations
+ if (6 * bwordlen > len(wbuf)) {
+ return errors::overflow;
+ };
+
+ // From now on, buf will be indirectly used via wbuf. Therefore make
+ // sure it gets cleared in the end.
+ defer bytes::zero(buf);
+
+ let mq = wbuf[..bwordlen];
+ encode(mq, q);
+
+ let t1 = wbuf[bwordlen..2 * bwordlen];
+ encode(t1, p);
+
+ // compute modulus n
+ let t2 = wbuf[2 * bwordlen..4 * bwordlen];
+ zero(t2, mq[0]);
+ mulacc(t2, mq, t1);
+
+ // ceiled modulus length in bytes
+ const nlen = (priv.nbitlen + 7) >> 3;
+ if(len(x) != nlen) {
+ bytes::zero(x);
+ return errors::invalid;
+ };
+
+ let t3 = wbuf[4 * bwordlen..6 * bwordlen];
+ let t3 = (t3: *[*]u8)[..nlen];
+ decode(t3, t2);
+ let r: u32 = 0;
+
+ // Check if x is mod n.
+ //
+ // We encode the modulus into bytes, to perform the comparison with
+ // bytes. We know that the product length, in bytes, is exactly nlen.
+ //
+ // The comparison actually computes the carry when subtracting the
+ // modulus from the source value; that carry must be 1 for a value in
+ // the correct range. We keep it in r, which is our accumulator for the
+ // error code.
+ for (let u = nlen; u > 0) {
+ u -= 1;
+ r = ((x[u] - (t3[u] + r)) >> 8) & 1;
+ };
+
+ // Move the decoded p to another temporary buffer.
+ let mp = wbuf[2 * bwordlen..3 * bwordlen];
+ mp[..] = t1[..];
+
+ // Compute s2 = x^dq mod q.
+ const q0i = ninv(mq[1]);
+ let s2 = wbuf[bwordlen..bwordlen * 3];
+ encodereduce(s2, x, mq);
+ r &= modpow(s2, priv.dq, mq, q0i, wbuf[3 * bwordlen..]);
+
+ // Compute s1 = x^dp mod p.
+ const p0i = ninv(mp[1]);
+ let s1 = wbuf[bwordlen * 3..];
+ encodereduce(s1, x, mp);
+ r &= modpow(s1, priv.dp, mp, p0i, wbuf[4 * bwordlen..]);
+
+ // Compute:
+ // h = (s1 - s2)*(1/q) mod p
+ // s1 is an integer modulo p, but s2 is modulo q. PKCS#1 is
+ // unclear about whether p may be lower than q (some existing,
+ // widely deployed implementations of RSA don't tolerate p < q),
+ // but we want to support that occurrence, so we need to use the
+ // reduction function.
+ //
+ // Since we use br_i31_decode_reduce() for iq (purportedly, the
+ // inverse of q modulo p), we also tolerate improperly large
+ // values for this parameter.
+ let t1 = wbuf[4 * bwordlen..5 * bwordlen];
+ let t2 = wbuf[5 * bwordlen..];
+
+ reduce(t2, s2, mp);
+ add(s1, mp, sub(s1, t2, 1));
+ tomonty(s1, mp);
+ encodereduce(t1, priv.iq, mp);
+ montymul(t2, s1, t1, mp, p0i);
+
+ // h is now in t2. We compute the final result:
+ // s = s2 + q*h
+ // All these operations are non-modular.
+ //
+ // We need mq, s2 and t2. We use the t3 buffer as destination.
+ // The buffers mp, s1 and t1 are no longer needed, so we can
+ // reuse them for t3. Moreover, the first step of the computation
+ // is to copy s2 into t3, after which s2 is not needed. Right
+ // now, mq is in slot 0, s2 is in slot 1, and t2 is in slot 5.
+ // Therefore, we have ample room for t3 by simply using s2.
+ let t3 = s2;
+ mulacc(t3, mq, t2);
+
+ // Encode the result. Since we already checked the value of xlen,
+ // we can just use it right away.
+ decode(x, t3);
+
+ if ((p0i & q0i & r) != 1) {
+ bytes::zero(x);
+ return errors::invalid;
+ };
+};
diff --git a/crypto/rsa/errors.ha b/crypto/rsa/errors.ha
@@ -0,0 +1,25 @@
+// License: MPL-2.0
+// (c) 2022 Armin Preiml <apreiml@strohwolke.at>
+use errors;
+
+// Signature verification failed.
+export type badsig = !void;
+
+// A tagged union of all RSA error types.
+export type error = !(
+ badsig |
+ errors::overflow |
+ errors::invalid
+);
+
+// Converts an [[error]] into a human-friendly string representation.
+export fn strerror(err: error) str = {
+ match (err) {
+ case badsig =>
+ return "Signature verification failed";
+ case errors::overflow =>
+ return "Key or key operation exceeds given buffer size";
+ case errors::invalid =>
+ return errors::strerror(errors::invalid);
+ };
+};
diff --git a/crypto/rsa/keys.ha b/crypto/rsa/keys.ha
@@ -0,0 +1,323 @@
+// License: MPL-2.0
+// (c) 2022 Armin Preiml <apreiml@strohwolke.at>
+use bufio;
+use bytes;
+use crypto::bigint;
+use crypto::math::*;
+use endian;
+use errors;
+use io;
+use types;
+
+// The default bit size of RSA keys is 4096-bit. Used as base for buffer sizes.
+export def BITSIZE: size = 4096;
+
+// The minimum bit size of RSA keys used only for validation during key init.
+// The default value is 1024-bit.
+export def MINBITSIZE: size = 1024;
+
+// RSA key parameters for initializing public keys with [[pubkey_init]].
+export type pubparams = struct {
+ // Modulus in big-endian order
+ n: []u8,
+
+ // Public exponent in big-endian order
+ e: []u8,
+};
+
+// RSA key parameters for initializing private keys with [[privkey_init]]. If
+// the private exponent d is available, [[privkey_initd]] may be used, which
+// derives 'dp' and 'dq'. All big integer values are in big-endian order.
+export type privparams = struct {
+ // Bit length of the modulus n. If unknown, the modulus can be provided
+ // to the init function, which derivces the length.
+ nbitlen: size,
+
+ // First prime factor.
+ p: []u8,
+
+ // Second prime factor
+ q: []u8,
+
+ // First exponent. dp = d mod (p - 1) where d is the private exponent.
+ // May be omitted on [[privkey_initd]].
+ dp: []u8,
+
+ // Second exponent. dq = d mod (q - 1) where d is the private exponent.
+ // May be omitted on [[privkey_initd]].
+ dq: []u8,
+
+ // Coefficient. iq = q^-1 mod p.
+ iq: []u8,
+};
+
+// Size required to store a public key of [[BITSIZE]] length.
+export def PUBKEYSIZE: size = 5 + 2 * (BITSIZE >> 3);
+
+// Initializes a public key from given [[pubparams]] 'x'. The data format
+// of 'pubkey' is subject to change and must not be used to serialize the key.
+// [[PUBKEYSIZE]] defines the required size to store a key of [[BITSIZE]].
+//
+// If given key does not fit into 'pubkey' or is too small, [[errors::overflow]]
+// is returned. Returns [[errors::invalid]], if given key parameters are
+// invalid. Returns the number of bytes written to 'pubkey' on success.
+export fn pubkey_init(pubkey: []u8, x: pubparams) (size | error) = {
+ let e = ltrim(x.e);
+ let n = ltrim(x.n);
+
+ if (len(pubkey) < pubkey_len(n, e) || len(n) > types::U16_MAX
+ || len(e) > types::U16_MAX) {
+ return errors::overflow;
+ };
+
+ // Very basic key checks that only catch obvious errors.
+ if ((len(e) == 1 && e[0] == 1) || len(e) > len(n)) {
+ return errors::invalid;
+ };
+ if (bitlen(n) < MINBITSIZE) {
+ return errors::invalid;
+ };
+
+ let w = bufio::fixed(pubkey, io::mode::WRITE);
+
+ let s = 0z;
+ s += writeslice(&w, e)!;
+ s += writeslice(&w, n)!;
+ return s;
+};
+
+// Returns the length the public key would require in its encoded form.
+fn pubkey_len(n: []u8, e: []u8) size = 1z + 2 + len(n) + 2 + len(e);
+
+// Returns the slice without preceeding zeroes.
+fn ltrim(s: []u8) []u8 = {
+ for (len(s) > 0 && s[0] == 0) {
+ s = s[1..];
+ };
+ return s;
+};
+
+fn writeslice(dest: io::handle, a: []u8) (size | io::error) = {
+ let lenbuf: [2]u8 = [0...];
+ endian::beputu16(lenbuf, len(a): u16);
+ let s = io::write(dest, lenbuf)?;
+ s += io::write(dest, a)?;
+ return s;
+};
+
+// Counts the bits for given slice 'n'.
+fn bitlen(s: []u8) size = {
+ for (s[0] == 0) {
+ s = s[1..];
+ };
+
+ return countbits(s[0]) + 8 * (len(s) - 1);
+};
+
+fn countbits(x: u8) size = {
+ let k: u32 = nequ32(x, 0);
+ let c: u32 = 0;
+
+ c = gtu32(x, 0x0f);
+ x = muxu32(c, x >> 4, x): u8;
+ k += c << 2;
+
+ c = gtu32(x, 0x03);
+ x = muxu32(c, x >> 2, x): u8;
+ k += c << 1;
+
+ k += gtu32(x, 0x01);
+
+ return k;
+};
+
+@test fn countbits() void = {
+ assert(countbits(0xf0) == 8);
+ assert(countbits(0x70) == 7);
+ assert(countbits(0x30) == 6);
+ assert(countbits(0x10) == 5);
+ assert(countbits(0x08) == 4);
+ assert(countbits(0x04) == 3);
+ assert(countbits(0x03) == 2);
+ assert(countbits(0x01) == 1);
+ assert(countbits(0x00) == 0);
+};
+
+// Returns the public key parameters, borrowed from given 'pubkey'.
+export fn pubkey_params(pubkey: []u8) pubparams = {
+ let keybuf = pubkey;
+ return pubparams {
+ e = nextslice(&keybuf),
+ n = nextslice(&keybuf),
+ };
+};
+
+fn nextslice(key: *[]u8) []u8 = {
+ const l = endian::begetu16(key[..2]);
+ let s = key[2..2 + l];
+ *key = key[2 + l..];
+ return s;
+};
+
+// Size required to store a private key of [[BITSIZE]] length.
+export def PRIVKEYSIZE: size = 13 + (MAXFACTOR >> 3) * 5;
+
+fn privkey_len(x: *privparams) size =
+ 13z + len(x.p) + len(x.q) + len(x.dp) + len(x.dq) + len(x.iq);
+
+// Initializes the private key 'privkey' using the values from 'x'. 'nbitlen' of
+// 'x' may be omitted, if the modulus 'n' is passed. All other values of 'x'
+// must be present. If 'x' is missing 'dp' and 'dq' use [[privkey_initd]].
+//
+// In case of invalid parameters or if the key is too small, [[errors::invalid]]
+// is returned. If the key does not fit 'privkey', [[errors::overflow]] is
+// returned. On success the number of bytes written to 'privkey' is returned.
+export fn privkey_init(privkey: []u8, x: privparams, n: []u8...) (size | error) = {
+ privkey_normalize(privkey, &x)?;
+
+ if (len(x.dp) == 0 || len(x.dq) == 0) {
+ return errors::invalid;
+ };
+
+ let s = privkey_writehead(privkey, &x, n...)?;
+ let w = bufio::fixed(privkey[s..], io::mode::WRITE);
+
+ s += writeslice(&w, x.dp)!;
+ s += writeslice(&w, x.dq)!;
+
+ s += writeslice(&w, x.iq)!;
+ s += writeslice(&w, x.p)!;
+ s += writeslice(&w, x.q)!;
+ return s;
+};
+
+// Trims key parameters and also does basic key checks.
+fn privkey_normalize(privkey: []u8, x: *privparams) (void | error) = {
+ x.p = ltrim(x.p);
+ x.q = ltrim(x.q);
+ x.dp = ltrim(x.dp);
+ x.dq = ltrim(x.dq);
+ x.iq = ltrim(x.iq);
+
+ if (len(privkey) < privkey_len(x)
+ || len(x.p) > types::U16_MAX
+ || len(x.q) > types::U16_MAX
+ || len(x.dp) > types::U16_MAX
+ || len(x.dq) > types::U16_MAX
+ || len(x.iq) > types::U16_MAX) {
+ return errors::overflow;
+ };
+
+ if (len(x.p) == 0 || len(x.q) == 0 || len(x.iq) == 0
+ || !isodd(x.p) || !isodd(x.q)) {
+ return errors::invalid;
+ };
+};
+
+fn isodd(x: []u8) bool = {
+ assert(len(x) > 0);
+ return x[len(x)-1] & 1 == 1;
+};
+
+fn privkey_writehead(
+ privkey: []u8,
+ p: *privparams,
+ n: []u8...
+) (size | error) = {
+ assert(len(n) <= 1);
+ const nbitlen = if (len(n) == 1) bitlen(n[0]) else p.nbitlen;
+ if (nbitlen > types::U16_MAX) {
+ return errors::overflow;
+ };
+ if (nbitlen < MINBITSIZE) {
+ return errors::invalid;
+ };
+
+ let w = bufio::fixed(privkey, io::mode::WRITE);
+ let lenbuf: [2]u8 = [0...];
+ endian::beputu16(lenbuf, nbitlen: u16);
+ return io::write(&w, lenbuf)!;
+};
+
+// Initializes the private key 'privkey' using the values from 'x' and the
+// secret exponent 'd'. 'dp' and 'dq' will be derived from 'p' and 'q' of 'x'.
+// 'nbitlen' of 'x' may be omitted, if the modulus 'n' is passed. 'x' must
+// provide 'iq'.
+//
+// In case of invalid parameters or if the key is too small, [[errors::invalid]]
+// is returned. If the key does not fit 'privkey', [[errors::overflow]] is
+// returned. On success the number of bytes written to 'privkey' is returend.
+export fn privkey_initd(
+ privkey: []u8,
+ x: privparams,
+ d: []u8,
+ n: []u8...
+) (size | error) = {
+ privkey_normalize(privkey, &x)?;
+
+ let s = privkey_writehead(privkey, &x, n...)?;
+
+ // the order is important. The dmod operation uses the space for the
+ // remaining factors as buffer.
+ s += privkey_dmod(privkey[s..], d, x.p);
+ s += privkey_dmod(privkey[s..], d, x.q);
+
+ let w = bufio::fixed(privkey[s..], io::mode::WRITE);
+ s += writeslice(&w, x.iq)!;
+ s += writeslice(&w, x.p)!;
+ s += writeslice(&w, x.q)!;
+
+ // zero out tail in case the privkey_dmod operation left buffered values
+ bytes::zero(privkey[s..]);
+ return s;
+};
+
+// Calculates 'x' = 'd' mod 'y' - 1 and stores 'x' into 'out' preceeding a
+// u16 len. 'out' will also be used as a calculation buffer. 'y' must be odd.
+fn privkey_dmod(out: []u8, d: []u8, y: []u8) size = {
+ const encwordlen = bigint::encodelen(y);
+ const enclen = encwordlen * size(bigint::word);
+ const xlen = len(y);
+
+ assert(len(out) >= 2 + xlen + 2 * enclen);
+ assert(isodd(y));
+
+ let buf = out[2 + xlen..];
+ // XXX: this may be only done once for both dp and dq
+ let by = (buf[..enclen]: *[*]bigint::word)[..encwordlen];
+ bigint::encode(by, y);
+ bigint::decrodd(by);
+
+ let bx = (buf[enclen..2 * enclen]: *[*]bigint::word)[..encwordlen];
+ bigint::encodereduce(bx, d, by);
+
+ out[0] = (xlen >> 8): u8;
+ out[1] = xlen: u8;
+ bigint::decode(out[2..2 + xlen], bx);
+ return 2 + xlen;
+};
+
+// Returns the private key parameters borrowed from 'privkey'.
+export fn privkey_params(privkey: []u8) privparams = {
+ let keybuf = privkey[2..];
+ return privparams {
+ nbitlen = privkey_nbitlen(privkey),
+ dp = nextslice(&keybuf),
+ dq = nextslice(&keybuf),
+ iq = nextslice(&keybuf),
+ p = nextslice(&keybuf),
+ q = nextslice(&keybuf),
+ ...
+ };
+};
+
+// Returns the length of the modulus 'n'.
+export fn privkey_nbitlen(privkey: []u8) size = {
+ return endian::begetu16(privkey[0..2]);
+};
+
+// Returns the number of bytes that are required to store a value modulo 'n'.
+export fn privkey_nsize(privkey: []u8) size = {
+ return (privkey_nbitlen(privkey) + 7) / 8;
+};
+
