_ Git - BearSSL/blob - inc/bearssl_rsa.h

   1 /*
   2  * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
   3  *
   4  * Permission is hereby granted, free of charge, to any person obtaining
   5  * a copy of this software and associated documentation files (the
   6  * "Software"), to deal in the Software without restriction, including
   7  * without limitation the rights to use, copy, modify, merge, publish,
   8  * distribute, sublicense, and/or sell copies of the Software, and to
   9  * permit persons to whom the Software is furnished to do so, subject to
  10  * the following conditions:
  11  *
  12  * The above copyright notice and this permission notice shall be
  13  * included in all copies or substantial portions of the Software.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  22  * SOFTWARE.
  23  */
  24
  25 #ifndef BR_BEARSSL_RSA_H__
  26 #define BR_BEARSSL_RSA_H__
  27
  28 #include <stddef.h>
  29 #include <stdint.h>
  30
  31 #ifdef __cplusplus
  32 extern "C" {
  33 #endif
  34
  35 /** \file bearssl_rsa.h
  36  *
  37  * # RSA
  38  *
  39  * This file documents the RSA implementations provided with BearSSL.
  40  * Note that the SSL engine accesses these implementations through a
  41  * configurable API, so it is possible to, for instance, run a SSL
  42  * server which uses a RSA engine which is not based on this code.
  43  *
  44  * ## Key Elements
  45  *
  46  * RSA public and private keys consist in lists of big integers. All
  47  * such integers are represented with big-endian unsigned notation:
  48  * first byte is the most significant, and the value is positive (so
  49  * there is no dedicated "sign bit"). Public and private key structures
  50  * thus contain, for each such integer, a pointer to the first value byte
  51  * (`unsigned char *`), and a length (`size_t`) which is the number of
  52  * relevant bytes. As a general rule, minimal-length encoding is not
  53  * enforced: values may have extra leading bytes of value 0.
  54  *
  55  * RSA public keys consist in two integers:
  56  *
  57  *   - the modulus (`n`);
  58  *   - the public exponent (`e`).
  59  *
  60  * RSA private keys, as defined in
  61  * [PKCS#1](https://tools.ietf.org/html/rfc3447), contain eight integers:
  62  *
  63  *   - the modulus (`n`);
  64  *   - the public exponent (`e`);
  65  *   - the private exponent (`d`);
  66  *   - the first prime factor (`p`);
  67  *   - the second prime factor (`q`);
  68  *   - the first reduced exponent (`dp`, which is `d` modulo `p-1`);
  69  *   - the second reduced exponent (`dq`, which is `d` modulo `q-1`);
  70  *   - the CRT coefficient (`iq`, the inverse of `q` modulo `p`).
  71  *
  72  * However, the implementations defined in BearSSL use only five of
  73  * these integers: `p`, `q`, `dp`, `dq` and `iq`.
  74  *
  75  * ## Security Features and Limitations
  76  *
  77  * The implementations contained in BearSSL have the following limitations
  78  * and features:
  79  *
  80  *   - They are constant-time. This means that the execution time and
  81  *     memory access pattern may depend on the _lengths_ of the private
  82  *     key components, but not on their value, nor on the value of
  83  *     the operand. Note that this property is not achieved through
  84  *     random masking, but "true" constant-time code.
  85  *
  86  *   - They support only private keys with two prime factors. RSA private
  87  *     key with three or more prime factors are nominally supported, but
  88  *     rarely used; they may offer faster operations, at the expense of
  89  *     more code and potentially a reduction in security if there are
  90  *     "too many" prime factors.
  91  *
  92  *   - The public exponent may have arbitrary length. Of course, it is
  93  *     a good idea to keep public exponents small, so that public key
  94  *     operations are fast; but, contrary to some widely deployed
  95  *     implementations, BearSSL has no problem with public exponent
  96  *     longer than 32 bits.
  97  *
  98  *   - The two prime factors of the modulus need not have the same length
  99  *     (but severely imbalanced factor lengths might reduce security).
 100  *     Similarly, there is no requirement that the first factor (`p`)
 101  *     be greater than the second factor (`q`).
 102  *
 103  *   - Prime factors and modulus must be smaller than a compile-time limit.
 104  *     This is made necessary by the use of fixed-size stack buffers, and
 105  *     the limit has been adjusted to keep stack usage under 2 kB for the
 106  *     RSA operations. Currently, the maximum modulus size is 4096 bits,
 107  *     and the maximum prime factor size is 2080 bits.
 108  *
 109  *   - The RSA functions themselves do not enforce lower size limits,
 110  *     except that which is absolutely necessary for the operation to
 111  *     mathematically make sense (e.g. a PKCS#1 v1.5 signature with
 112  *     SHA-1 requires a modulus of at least 361 bits). It is up to users
 113  *     of this code to enforce size limitations when appropriate (e.g.
 114  *     the X.509 validation engine, by default, rejects RSA keys of
 115  *     less than 1017 bits).
 116  *
 117  *   - Within the size constraints expressed above, arbitrary bit lengths
 118  *     are supported. There is no requirement that prime factors or
 119  *     modulus have a size multiple of 8 or 16.
 120  *
 121  *   - When verifying PKCS#1 v1.5 signatures, both variants of the hash
 122  *     function identifying header (with and without the ASN.1 NULL) are
 123  *     supported. When producing such signatures, the variant with the
 124  *     ASN.1 NULL is used.
 125  *
 126  * ## Implementations
 127  *
 128  * Three RSA implementations are included:
 129  *
 130  *   - The **i32** implementation internally represents big integers
 131  *     as arrays of 32-bit integers. It is perfunctory and portable,
 132  *     but not very efficient.
 133  *
 134  *   - The **i31** implementation uses 32-bit integers, each containing
 135  *     31 bits worth of integer data. The i31 implementation is somewhat
 136  *     faster than the i32 implementation (the reduced integer size makes
 137  *     carry propagation easier) for a similar code footprint, but uses
 138  *     very slightly larger stack buffers (about 4% bigger).
 139  *
 140  *   - The **i62** implementation is similar to the i31 implementation,
 141  *     except that it internally leverages the 64x64->128 multiplication
 142  *     opcode. This implementation is available only on architectures
 143  *     where such an opcode exists. It is much faster than i31.
 144  *
 145  *   - The **i15** implementation uses 16-bit integers, each containing
 146  *     15 bits worth of integer data. Multiplication results fit on
 147  *     32 bits, so this won't use the "widening" multiplication routine
 148  *     on ARM Cortex M0/M0+, for much better performance and constant-time
 149  *     execution.
 150  */
 151
 152 /**
 153  * \brief RSA public key.
 154  *
 155  * The structure references the modulus and the public exponent. Both
 156  * integers use unsigned big-endian representation; extra leading bytes
 157  * of value 0 are allowed.
 158  */
 159 typedef struct {
 160         /** \brief Modulus. */
 161         unsigned char *n;
 162         /** \brief Modulus length (in bytes). */
 163         size_t nlen;
 164         /** \brief Public exponent. */
 165         unsigned char *e;
 166         /** \brief Public exponent length (in bytes). */
 167         size_t elen;
 168 } br_rsa_public_key;
 169
 170 /**
 171  * \brief RSA private key.
 172  *
 173  * The structure references the primvate factors, reduced private
 174  * exponents, and CRT coefficient. It also contains the bit length of
 175  * the modulus. The big integers use unsigned big-endian representation;
 176  * extra leading bytes of value 0 are allowed. However, the modulus bit
 177  * length (`n_bitlen`) MUST be exact.
 178  */
 179 typedef struct {
 180         /** \brief Modulus bit length (in bits, exact value). */
 181         uint32_t n_bitlen;
 182         /** \brief First prime factor. */
 183         unsigned char *p;
 184         /** \brief First prime factor length (in bytes). */
 185         size_t plen;
 186         /** \brief Second prime factor. */
 187         unsigned char *q;
 188         /** \brief Second prime factor length (in bytes). */
 189         size_t qlen;
 190         /** \brief First reduced private exponent. */
 191         unsigned char *dp;
 192         /** \brief First reduced private exponent length (in bytes). */
 193         size_t dplen;
 194         /** \brief Second reduced private exponent. */
 195         unsigned char *dq;
 196         /** \brief Second reduced private exponent length (in bytes). */
 197         size_t dqlen;
 198         /** \brief CRT coefficient. */
 199         unsigned char *iq;
 200         /** \brief CRT coefficient length (in bytes). */
 201         size_t iqlen;
 202 } br_rsa_private_key;
 203
 204 /**
 205  * \brief Type for a RSA public key engine.
 206  *
 207  * The public key engine performs the modular exponentiation of the
 208  * provided value with the public exponent. The value is modified in
 209  * place.
 210  *
 211  * The value length (`xlen`) is verified to have _exactly_ the same
 212  * length as the modulus (actual modulus length, without extra leading
 213  * zeros in the modulus representation in memory). If the length does
 214  * not match, then this function returns 0 and `x[]` is unmodified.
 215  *
 216  * It `xlen` is correct, then `x[]` is modified. Returned value is 1
 217  * on success, 0 on error. Error conditions include an oversized `x[]`
 218  * (the array has the same length as the modulus, but the numerical value
 219  * is not lower than the modulus) and an invalid modulus (e.g. an even
 220  * integer). If an error is reported, then the new contents of `x[]` are
 221  * unspecified.
 222  *
 223  * \param x      operand to exponentiate.
 224  * \param xlen   length of the operand (in bytes).
 225  * \param pk     RSA public key.
 226  * \return  1 on success, 0 on error.
 227  */
 228 typedef uint32_t (*br_rsa_public)(unsigned char *x, size_t xlen,
 229         const br_rsa_public_key *pk);
 230
 231 /**
 232  * \brief Type for a RSA signature verification engine (PKCS#1 v1.5).
 233  *
 234  * Parameters are:
 235  *
 236  *   - The signature itself. The provided array is NOT modified.
 237  *
 238  *   - The encoded OID for the hash function. The provided array must begin
 239  *     with a single byte that contains the length of the OID value (in
 240  *     bytes), followed by exactly that many bytes. This parameter may
 241  *     also be `NULL`, in which case the raw hash value should be used
 242  *     with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
 243  *     to TLS-1.1, with a 36-byte hash value).
 244  *
 245  *   - The hash output length, in bytes.
 246  *
 247  *   - The public key.
 248  *
 249  *   - An output buffer for the hash value. The caller must still compare
 250  *     it with the hash of the data over which the signature is computed.
 251  *
 252  * **Constraints:**
 253  *
 254  *   - Hash length MUST be no more than 64 bytes.
 255  *
 256  *   - OID value length MUST be no more than 32 bytes (i.e. `hash_oid[0]`
 257  *     must have a value in the 0..32 range, inclusive).
 258  *
 259  * This function verifies that the signature length (`xlen`) matches the
 260  * modulus length (this function returns 0 on mismatch). If the modulus
 261  * size exceeds the maximum supported RSA size, then the function also
 262  * returns 0.
 263  *
 264  * Returned value is 1 on success, 0 on error.
 265  *
 266  * Implementations of this type need not be constant-time.
 267  *
 268  * \param x          signature buffer.
 269  * \param xlen       signature length (in bytes).
 270  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 271  * \param hash_len   expected hash value length (in bytes).
 272  * \param pk         RSA public key.
 273  * \param hash_out   output buffer for the hash value.
 274  * \return  1 on success, 0 on error.
 275  */
 276 typedef uint32_t (*br_rsa_pkcs1_vrfy)(const unsigned char *x, size_t xlen,
 277         const unsigned char *hash_oid, size_t hash_len,
 278         const br_rsa_public_key *pk, unsigned char *hash_out);
 279
 280 /**
 281  * \brief Type for a RSA private key engine.
 282  *
 283  * The `x[]` buffer is modified in place, and its length is inferred from
 284  * the modulus length (`x[]` is assumed to have a length of
 285  * `(sk->n_bitlen+7)/8` bytes).
 286  *
 287  * Returned value is 1 on success, 0 on error.
 288  *
 289  * \param x    operand to exponentiate.
 290  * \param sk   RSA private key.
 291  * \return  1 on success, 0 on error.
 292  */
 293 typedef uint32_t (*br_rsa_private)(unsigned char *x,
 294         const br_rsa_private_key *sk);
 295
 296 /**
 297  * \brief Type for a RSA signature generation engine (PKCS#1 v1.5).
 298  *
 299  * Parameters are:
 300  *
 301  *   - The encoded OID for the hash function. The provided array must begin
 302  *     with a single byte that contains the length of the OID value (in
 303  *     bytes), followed by exactly that many bytes. This parameter may
 304  *     also be `NULL`, in which case the raw hash value should be used
 305  *     with the PKCS#1 v1.5 "type 1" padding (as used in SSL/TLS up
 306  *     to TLS-1.1, with a 36-byte hash value).
 307  *
 308  *   - The hash value computes over the data to sign (its length is
 309  *     expressed in bytes).
 310  *
 311  *   - The RSA private key.
 312  *
 313  *   - The output buffer, that receives the signature.
 314  *
 315  * Returned value is 1 on success, 0 on error. Error conditions include
 316  * a too small modulus for the provided hash OID and value, or some
 317  * invalid key parameters. The signature length is exactly
 318  * `(sk->n_bitlen+7)/8` bytes.
 319  *
 320  * This function is expected to be constant-time with regards to the
 321  * private key bytes (lengths of the modulus and the individual factors
 322  * may leak, though) and to the hashed data.
 323  *
 324  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 325  * \param hash       hash value.
 326  * \param hash_len   hash value length (in bytes).
 327  * \param sk         RSA private key.
 328  * \param x          output buffer for the signature value.
 329  * \return  1 on success, 0 on error.
 330  */
 331 typedef uint32_t (*br_rsa_pkcs1_sign)(const unsigned char *hash_oid,
 332         const unsigned char *hash, size_t hash_len,
 333         const br_rsa_private_key *sk, unsigned char *x);
 334
 335 /**
 336  * \brief Encoded OID for SHA-1 (in RSA PKCS#1 signatures).
 337  */
 338 #define BR_HASH_OID_SHA1     \
 339         ((const unsigned char *)"\x05\x2B\x0E\x03\x02\x1A")
 340
 341 /**
 342  * \brief Encoded OID for SHA-224 (in RSA PKCS#1 signatures).
 343  */
 344 #define BR_HASH_OID_SHA224   \
 345         ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x04")
 346
 347 /**
 348  * \brief Encoded OID for SHA-256 (in RSA PKCS#1 signatures).
 349  */
 350 #define BR_HASH_OID_SHA256   \
 351         ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01")
 352
 353 /**
 354  * \brief Encoded OID for SHA-384 (in RSA PKCS#1 signatures).
 355  */
 356 #define BR_HASH_OID_SHA384   \
 357         ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x02")
 358
 359 /**
 360  * \brief Encoded OID for SHA-512 (in RSA PKCS#1 signatures).
 361  */
 362 #define BR_HASH_OID_SHA512   \
 363         ((const unsigned char *)"\x09\x60\x86\x48\x01\x65\x03\x04\x02\x03")
 364
 365 /*
 366  * RSA "i32" engine. Integers are internally represented as arrays of
 367  * 32-bit integers, and the core multiplication primitive is the
 368  * 32x32->64 multiplication.
 369  */
 370
 371 /**
 372  * \brief RSA public key engine "i32".
 373  *
 374  * \see br_rsa_public
 375  *
 376  * \param x      operand to exponentiate.
 377  * \param xlen   length of the operand (in bytes).
 378  * \param pk     RSA public key.
 379  * \return  1 on success, 0 on error.
 380  */
 381 uint32_t br_rsa_i32_public(unsigned char *x, size_t xlen,
 382         const br_rsa_public_key *pk);
 383
 384 /**
 385  * \brief RSA signature verification engine "i32".
 386  *
 387  * \see br_rsa_pkcs1_vrfy
 388  *
 389  * \param x          signature buffer.
 390  * \param xlen       signature length (in bytes).
 391  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 392  * \param hash_len   expected hash value length (in bytes).
 393  * \param pk         RSA public key.
 394  * \param hash_out   output buffer for the hash value.
 395  * \return  1 on success, 0 on error.
 396  */
 397 uint32_t br_rsa_i32_pkcs1_vrfy(const unsigned char *x, size_t xlen,
 398         const unsigned char *hash_oid, size_t hash_len,
 399         const br_rsa_public_key *pk, unsigned char *hash_out);
 400
 401 /**
 402  * \brief RSA private key engine "i32".
 403  *
 404  * \see br_rsa_private
 405  *
 406  * \param x    operand to exponentiate.
 407  * \param sk   RSA private key.
 408  * \return  1 on success, 0 on error.
 409  */
 410 uint32_t br_rsa_i32_private(unsigned char *x,
 411         const br_rsa_private_key *sk);
 412
 413 /**
 414  * \brief RSA signature generation engine "i32".
 415  *
 416  * \see br_rsa_pkcs1_sign
 417  *
 418  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 419  * \param hash       hash value.
 420  * \param hash_len   hash value length (in bytes).
 421  * \param sk         RSA private key.
 422  * \param x          output buffer for the hash value.
 423  * \return  1 on success, 0 on error.
 424  */
 425 uint32_t br_rsa_i32_pkcs1_sign(const unsigned char *hash_oid,
 426         const unsigned char *hash, size_t hash_len,
 427         const br_rsa_private_key *sk, unsigned char *x);
 428
 429 /*
 430  * RSA "i31" engine. Similar to i32, but only 31 bits are used per 32-bit
 431  * word. This uses slightly more stack space (about 4% more) and code
 432  * space, but it quite faster.
 433  */
 434
 435 /**
 436  * \brief RSA public key engine "i31".
 437  *
 438  * \see br_rsa_public
 439  *
 440  * \param x      operand to exponentiate.
 441  * \param xlen   length of the operand (in bytes).
 442  * \param pk     RSA public key.
 443  * \return  1 on success, 0 on error.
 444  */
 445 uint32_t br_rsa_i31_public(unsigned char *x, size_t xlen,
 446         const br_rsa_public_key *pk);
 447
 448 /**
 449  * \brief RSA signature verification engine "i31".
 450  *
 451  * \see br_rsa_pkcs1_vrfy
 452  *
 453  * \param x          signature buffer.
 454  * \param xlen       signature length (in bytes).
 455  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 456  * \param hash_len   expected hash value length (in bytes).
 457  * \param pk         RSA public key.
 458  * \param hash_out   output buffer for the hash value.
 459  * \return  1 on success, 0 on error.
 460  */
 461 uint32_t br_rsa_i31_pkcs1_vrfy(const unsigned char *x, size_t xlen,
 462         const unsigned char *hash_oid, size_t hash_len,
 463         const br_rsa_public_key *pk, unsigned char *hash_out);
 464
 465 /**
 466  * \brief RSA private key engine "i31".
 467  *
 468  * \see br_rsa_private
 469  *
 470  * \param x    operand to exponentiate.
 471  * \param sk   RSA private key.
 472  * \return  1 on success, 0 on error.
 473  */
 474 uint32_t br_rsa_i31_private(unsigned char *x,
 475         const br_rsa_private_key *sk);
 476
 477 /**
 478  * \brief RSA signature generation engine "i31".
 479  *
 480  * \see br_rsa_pkcs1_sign
 481  *
 482  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 483  * \param hash       hash value.
 484  * \param hash_len   hash value length (in bytes).
 485  * \param sk         RSA private key.
 486  * \param x          output buffer for the hash value.
 487  * \return  1 on success, 0 on error.
 488  */
 489 uint32_t br_rsa_i31_pkcs1_sign(const unsigned char *hash_oid,
 490         const unsigned char *hash, size_t hash_len,
 491         const br_rsa_private_key *sk, unsigned char *x);
 492
 493 /*
 494  * RSA "i62" engine. Similar to i31, but internal multiplication use
 495  * 64x64->128 multiplications. This is available only on architecture
 496  * that offer such an opcode.
 497  */
 498
 499 /**
 500  * \brief RSA public key engine "i62".
 501  *
 502  * This function is defined only on architecture that offer a 64x64->128
 503  * opcode. Use `br_rsa_i62_public_get()` to dynamically obtain a pointer
 504  * to that functiom.
 505  *
 506  * \see br_rsa_public
 507  *
 508  * \param x      operand to exponentiate.
 509  * \param xlen   length of the operand (in bytes).
 510  * \param pk     RSA public key.
 511  * \return  1 on success, 0 on error.
 512  */
 513 uint32_t br_rsa_i62_public(unsigned char *x, size_t xlen,
 514         const br_rsa_public_key *pk);
 515
 516 /**
 517  * \brief RSA signature verification engine "i62".
 518  *
 519  * This function is defined only on architecture that offer a 64x64->128
 520  * opcode. Use `br_rsa_i62_pkcs1_vrfy_get()` to dynamically obtain a pointer
 521  * to that functiom.
 522  *
 523  * \see br_rsa_pkcs1_vrfy
 524  *
 525  * \param x          signature buffer.
 526  * \param xlen       signature length (in bytes).
 527  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 528  * \param hash_len   expected hash value length (in bytes).
 529  * \param pk         RSA public key.
 530  * \param hash_out   output buffer for the hash value.
 531  * \return  1 on success, 0 on error.
 532  */
 533 uint32_t br_rsa_i62_pkcs1_vrfy(const unsigned char *x, size_t xlen,
 534         const unsigned char *hash_oid, size_t hash_len,
 535         const br_rsa_public_key *pk, unsigned char *hash_out);
 536
 537 /**
 538  * \brief RSA private key engine "i62".
 539  *
 540  * This function is defined only on architecture that offer a 64x64->128
 541  * opcode. Use `br_rsa_i62_private_get()` to dynamically obtain a pointer
 542  * to that functiom.
 543  *
 544  * \see br_rsa_private
 545  *
 546  * \param x    operand to exponentiate.
 547  * \param sk   RSA private key.
 548  * \return  1 on success, 0 on error.
 549  */
 550 uint32_t br_rsa_i62_private(unsigned char *x,
 551         const br_rsa_private_key *sk);
 552
 553 /**
 554  * \brief RSA signature generation engine "i62".
 555  *
 556  * This function is defined only on architecture that offer a 64x64->128
 557  * opcode. Use `br_rsa_i62_pkcs1_sign_get()` to dynamically obtain a pointer
 558  * to that functiom.
 559  *
 560  * \see br_rsa_pkcs1_sign
 561  *
 562  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 563  * \param hash       hash value.
 564  * \param hash_len   hash value length (in bytes).
 565  * \param sk         RSA private key.
 566  * \param x          output buffer for the hash value.
 567  * \return  1 on success, 0 on error.
 568  */
 569 uint32_t br_rsa_i62_pkcs1_sign(const unsigned char *hash_oid,
 570         const unsigned char *hash, size_t hash_len,
 571         const br_rsa_private_key *sk, unsigned char *x);
 572
 573 /**
 574  * \brief Get the RSA "i62" implementation (public key operations),
 575  * if available.
 576  *
 577  * \return  the implementation, or 0.
 578  */
 579 br_rsa_public br_rsa_i62_public_get(void);
 580
 581 /**
 582  * \brief Get the RSA "i62" implementation (PKCS#1 signature verification),
 583  * if available.
 584  *
 585  * \return  the implementation, or 0.
 586  */
 587 br_rsa_pkcs1_vrfy br_rsa_i62_pkcs1_vrfy_get(void);
 588
 589 /**
 590  * \brief Get the RSA "i62" implementation (private key operations),
 591  * if available.
 592  *
 593  * \return  the implementation, or 0.
 594  */
 595 br_rsa_private br_rsa_i62_private_get(void);
 596
 597 /**
 598  * \brief Get the RSA "i62" implementation (PKCS#1 signature generation),
 599  * if available.
 600  *
 601  * \return  the implementation, or 0.
 602  */
 603 br_rsa_pkcs1_sign br_rsa_i62_pkcs1_sign_get(void);
 604
 605 /*
 606  * RSA "i15" engine. Integers are represented as 15-bit integers, so
 607  * the code uses only 32-bit multiplication (no 64-bit result), which
 608  * is vastly faster (and constant-time) on the ARM Cortex M0/M0+.
 609  */
 610
 611 /**
 612  * \brief RSA public key engine "i15".
 613  *
 614  * \see br_rsa_public
 615  *
 616  * \param x      operand to exponentiate.
 617  * \param xlen   length of the operand (in bytes).
 618  * \param pk     RSA public key.
 619  * \return  1 on success, 0 on error.
 620  */
 621 uint32_t br_rsa_i15_public(unsigned char *x, size_t xlen,
 622         const br_rsa_public_key *pk);
 623
 624 /**
 625  * \brief RSA signature verification engine "i15".
 626  *
 627  * \see br_rsa_pkcs1_vrfy
 628  *
 629  * \param x          signature buffer.
 630  * \param xlen       signature length (in bytes).
 631  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 632  * \param hash_len   expected hash value length (in bytes).
 633  * \param pk         RSA public key.
 634  * \param hash_out   output buffer for the hash value.
 635  * \return  1 on success, 0 on error.
 636  */
 637 uint32_t br_rsa_i15_pkcs1_vrfy(const unsigned char *x, size_t xlen,
 638         const unsigned char *hash_oid, size_t hash_len,
 639         const br_rsa_public_key *pk, unsigned char *hash_out);
 640
 641 /**
 642  * \brief RSA private key engine "i15".
 643  *
 644  * \see br_rsa_private
 645  *
 646  * \param x    operand to exponentiate.
 647  * \param sk   RSA private key.
 648  * \return  1 on success, 0 on error.
 649  */
 650 uint32_t br_rsa_i15_private(unsigned char *x,
 651         const br_rsa_private_key *sk);
 652
 653 /**
 654  * \brief RSA signature generation engine "i15".
 655  *
 656  * \see br_rsa_pkcs1_sign
 657  *
 658  * \param hash_oid   encoded hash algorithm OID (or `NULL`).
 659  * \param hash       hash value.
 660  * \param hash_len   hash value length (in bytes).
 661  * \param sk         RSA private key.
 662  * \param x          output buffer for the hash value.
 663  * \return  1 on success, 0 on error.
 664  */
 665 uint32_t br_rsa_i15_pkcs1_sign(const unsigned char *hash_oid,
 666         const unsigned char *hash, size_t hash_len,
 667         const br_rsa_private_key *sk, unsigned char *x);
 668
 669 /**
 670  * \brief Get "default" RSA implementation (public-key operations).
 671  *
 672  * This returns the preferred implementation of RSA (public-key operations)
 673  * on the current system.
 674  *
 675  * \return  the default implementation.
 676  */
 677 br_rsa_public br_rsa_public_get_default(void);
 678
 679 /**
 680  * \brief Get "default" RSA implementation (private-key operations).
 681  *
 682  * This returns the preferred implementation of RSA (private-key operations)
 683  * on the current system.
 684  *
 685  * \return  the default implementation.
 686  */
 687 br_rsa_private br_rsa_private_get_default(void);
 688
 689 /**
 690  * \brief Get "default" RSA implementation (PKCS#1 signature verification).
 691  *
 692  * This returns the preferred implementation of RSA (signature verification)
 693  * on the current system.
 694  *
 695  * \return  the default implementation.
 696  */
 697 br_rsa_pkcs1_vrfy br_rsa_pkcs1_vrfy_get_default(void);
 698
 699 /**
 700  * \brief Get "default" RSA implementation (PKCS#1 signature generation).
 701  *
 702  * This returns the preferred implementation of RSA (signature generation)
 703  * on the current system.
 704  *
 705  * \return  the default implementation.
 706  */
 707 br_rsa_pkcs1_sign br_rsa_pkcs1_sign_get_default(void);
 708
 709 /**
 710  * \brief RSA decryption helper, for SSL/TLS.
 711  *
 712  * This function performs the RSA decryption for a RSA-based key exchange
 713  * in a SSL/TLS server. The provided RSA engine is used. The `data`
 714  * parameter points to the value to decrypt, of length `len` bytes. On
 715  * success, the 48-byte pre-master secret is copied into `data`, starting
 716  * at the first byte of that buffer; on error, the contents of `data`
 717  * become indeterminate.
 718  *
 719  * This function first checks that the provided value length (`len`) is
 720  * not lower than 59 bytes, and matches the RSA modulus length; if neither
 721  * of this property is met, then this function returns 0 and the buffer
 722  * is unmodified.
 723  *
 724  * Otherwise, decryption and then padding verification are performed, both
 725  * in constant-time. A decryption error, or a bad padding, or an
 726  * incorrect decrypted value length are reported with a returned value of
 727  * 0; on success, 1 is returned. The caller (SSL server engine) is supposed
 728  * to proceed with a random pre-master secret in case of error.
 729  *
 730  * \param core   RSA private key engine.
 731  * \param sk     RSA private key.
 732  * \param data   input/output buffer.
 733  * \param len    length (in bytes) of the data to decrypt.
 734  * \return  1 on success, 0 on error.
 735  */
 736 uint32_t br_rsa_ssl_decrypt(br_rsa_private core, const br_rsa_private_key *sk,
 737         unsigned char *data, size_t len);
 738
 739 #ifdef __cplusplus
 740 }
 741 #endif
 742
 743 #endif