Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- File List
- File Members

rsa.cpp
Go to the documentation of this file.
1 /*
2 * RSA
3 * (C) 1999-2010,2015,2016,2018,2019 Jack Lloyd
4 *
5 * Botan is released under the Simplified BSD License (see license.txt)
6 */
7
8 #include <botan/rsa.h>
9 #include <botan/internal/pk_ops_impl.h>
10 #include <botan/keypair.h>
11 #include <botan/blinding.h>
12 #include <botan/reducer.h>
13 #include <botan/workfactor.h>
14 #include <botan/der_enc.h>
15 #include <botan/ber_dec.h>
16 #include <botan/monty.h>
17 #include <botan/divide.h>
18 #include <botan/internal/monty_exp.h>
19
20 #if defined(BOTAN_HAS_OPENSSL)
21 #include <botan/internal/openssl.h>
22 #endif
23
24 #if defined(BOTAN_TARGET_OS_HAS_THREADS)
25 #include <future>
26 #endif
27
28 namespace Botan {
29
30 class RSA_Public_Data final
31 {
32 public:
33 RSA_Public_Data(BigInt&& n, BigInt&& e) :
34 m_n(n),
35 m_e(e),
36 m_monty_n(std::make_shared<Montgomery_Params>(m_n)),
37 m_public_modulus_bits(m_n.bits()),
38 m_public_modulus_bytes(m_n.bytes())
39 {}
40
41 BigInt public_op(const BigInt& m) const
42 {
43 const size_t powm_window = 1;
44 auto powm_m_n = monty_precompute(m_monty_n, m, powm_window, false);
45 return monty_execute_vartime(*powm_m_n, m_e);
46 }
47
48 const BigInt& get_n() const { return m_n; }
49 const BigInt& get_e() const { return m_e; }
50 size_t public_modulus_bits() const { return m_public_modulus_bits; }
51 size_t public_modulus_bytes() const { return m_public_modulus_bytes; }
52
53 private:
54 BigInt m_n;
55 BigInt m_e;
56 std::shared_ptr<const Montgomery_Params> m_monty_n;
57 size_t m_public_modulus_bits;
58 size_t m_public_modulus_bytes;
59 };
60
61 class RSA_Private_Data final
62 {
63 public:
64 RSA_Private_Data(BigInt&& d, BigInt&& p, BigInt&& q,
65 BigInt&& d1, BigInt&& d2, BigInt&& c) :
66 m_d(d),
67 m_p(p),
68 m_q(q),
69 m_d1(d1),
70 m_d2(d2),
71 m_c(c),
72 m_mod_p(m_p),
73 m_mod_q(m_q),
74 m_monty_p(std::make_shared<Montgomery_Params>(m_p, m_mod_p)),
75 m_monty_q(std::make_shared<Montgomery_Params>(m_q, m_mod_q)),
76 m_p_bits(m_p.bits()),
77 m_q_bits(m_q.bits())
78 {}
79
80 const BigInt& get_d() const { return m_d; }
81 const BigInt& get_p() const { return m_p; }
82 const BigInt& get_q() const { return m_q; }
83 const BigInt& get_d1() const { return m_d1; }
84 const BigInt& get_d2() const { return m_d2; }
85 const BigInt& get_c() const { return m_c; }
86
87 //private:
88 BigInt m_d;
89 BigInt m_p;
90 BigInt m_q;
91 BigInt m_d1;
92 BigInt m_d2;
93 BigInt m_c;
94
95 Modular_Reducer m_mod_p;
96 Modular_Reducer m_mod_q;
97 std::shared_ptr<const Montgomery_Params> m_monty_p;
98 std::shared_ptr<const Montgomery_Params> m_monty_q;
99 size_t m_p_bits;
100 size_t m_q_bits;
101 };
102
103 std::shared_ptr<const RSA_Public_Data> RSA_PublicKey::public_data() const
104 {
105 return m_public;
106 }
107
108 const BigInt& RSA_PublicKey::get_n() const { return m_public->get_n(); }
109 const BigInt& RSA_PublicKey::get_e() const { return m_public->get_e(); }
110
111 void RSA_PublicKey::init(BigInt&& n, BigInt&& e)
112 {
113 if(n.is_negative() || n.is_even() || e.is_negative() || e.is_even())
114 throw Decoding_Error("Invalid RSA public key parameters");
115 m_public = std::make_shared<RSA_Public_Data>(std::move(n), std::move(e));
116 }
117
118 RSA_PublicKey::RSA_PublicKey(const AlgorithmIdentifier&,
119 const std::vector<uint8_t>& key_bits)
120 {
121 BigInt n, e;
122 BER_Decoder(key_bits)
123 .start_cons(SEQUENCE)
124 .decode(n)
125 .decode(e)
126 .end_cons();
127
128 init(std::move(n), std::move(e));
129 }
130
131 RSA_PublicKey::RSA_PublicKey(const BigInt& modulus, const BigInt& exponent)
132 {
133 BigInt n = modulus;
134 BigInt e = exponent;
135 init(std::move(n), std::move(e));
136 }
137
138 size_t RSA_PublicKey::key_length() const
139 {
140 return m_public->public_modulus_bits();
141 }
142
143 size_t RSA_PublicKey::estimated_strength() const
144 {
145 return if_work_factor(key_length());
146 }
147
148 AlgorithmIdentifier RSA_PublicKey::algorithm_identifier() const
149 {
150 return AlgorithmIdentifier(get_oid(), AlgorithmIdentifier::USE_NULL_PARAM);
151 }
152
153 std::vector<uint8_t> RSA_PublicKey::public_key_bits() const
154 {
155 std::vector<uint8_t> output;
156 DER_Encoder der(output);
157 der.start_cons(SEQUENCE)
158 .encode(get_n())
159 .encode(get_e())
160 .end_cons();
161
162 return output;
163 }
164
165 /*
166 * Check RSA Public Parameters
167 */
168 bool RSA_PublicKey::check_key(RandomNumberGenerator&, bool) const
169 {
170 if(get_n() < 35 || get_n().is_even() || get_e() < 3 || get_e().is_even())
171 return false;
172 return true;
173 }
174
175 std::shared_ptr<const RSA_Private_Data> RSA_PrivateKey::private_data() const
176 {
177 return m_private;
178 }
179
180 secure_vector<uint8_t> RSA_PrivateKey::private_key_bits() const
181 {
182 return DER_Encoder()
183 .start_cons(SEQUENCE)
184 .encode(static_cast<size_t>(0))
185 .encode(get_n())
186 .encode(get_e())
187 .encode(get_d())
188 .encode(get_p())
189 .encode(get_q())
190 .encode(get_d1())
191 .encode(get_d2())
192 .encode(get_c())
193 .end_cons()
194 .get_contents();
195 }
196
197 const BigInt& RSA_PrivateKey::get_p() const { return m_private->get_p(); }
198 const BigInt& RSA_PrivateKey::get_q() const { return m_private->get_q(); }
199 const BigInt& RSA_PrivateKey::get_d() const { return m_private->get_d(); }
200 const BigInt& RSA_PrivateKey::get_c() const { return m_private->get_c(); }
201 const BigInt& RSA_PrivateKey::get_d1() const { return m_private->get_d1(); }
202 const BigInt& RSA_PrivateKey::get_d2() const { return m_private->get_d2(); }
203
204 void RSA_PrivateKey::init(BigInt&& d, BigInt&& p, BigInt&& q,
205 BigInt&& d1, BigInt&& d2, BigInt&& c)
206 {
207 m_private = std::make_shared<RSA_Private_Data>(
208 std::move(d), std::move(p), std::move(q), std::move(d1), std::move(d2), std::move(c));
209 }
210
211 RSA_PrivateKey::RSA_PrivateKey(const AlgorithmIdentifier&,
212 const secure_vector<uint8_t>& key_bits)
213 {
214 BigInt n, e, d, p, q, d1, d2, c;
215
216 BER_Decoder(key_bits)
217 .start_cons(SEQUENCE)
218 .decode_and_check<size_t>(0, "Unknown PKCS #1 key format version")
219 .decode(n)
220 .decode(e)
221 .decode(d)
222 .decode(p)
223 .decode(q)
224 .decode(d1)
225 .decode(d2)
226 .decode(c)
227 .end_cons();
228
229 RSA_PublicKey::init(std::move(n), std::move(e));
230
231 RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q),
232 std::move(d1), std::move(d2), std::move(c));
233 }
234
235 RSA_PrivateKey::RSA_PrivateKey(const BigInt& prime1,
236 const BigInt& prime2,
237 const BigInt& exp,
238 const BigInt& d_exp,
239 const BigInt& mod)
240 {
241 BigInt p = prime1;
242 BigInt q = prime2;
243 BigInt n = mod;
244 if(n.is_zero())
245 n = p * q;
246
247 BigInt e = exp;
248
249 BigInt d = d_exp;
250
251 const BigInt p_minus_1 = p - 1;
252 const BigInt q_minus_1 = q - 1;
253
254 if(d.is_zero())
255 {
256 const BigInt phi_n = lcm(p_minus_1, q_minus_1);
257 d = inverse_mod(e, phi_n);
258 }
259
260 BigInt d1 = ct_modulo(d, p_minus_1);
261 BigInt d2 = ct_modulo(d, q_minus_1);
262 BigInt c = inverse_mod(q, p);
263
264 RSA_PublicKey::init(std::move(n), std::move(e));
265
266 RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q),
267 std::move(d1), std::move(d2), std::move(c));
268 }
269
270 /*
271 * Create a RSA private key
272 */
273 RSA_PrivateKey::RSA_PrivateKey(RandomNumberGenerator& rng,
274 size_t bits, size_t exp)
275 {
276 if(bits < 1024)
277 throw Invalid_Argument(algo_name() + ": Can't make a key that is only " +
278 std::to_string(bits) + " bits long");
279 if(exp < 3 || exp % 2 == 0)
280 throw Invalid_Argument(algo_name() + ": Invalid encryption exponent");
281
282 BigInt n, e, d, p, q, d1, d2, c;
283
284 e = exp;
285
286 const size_t p_bits = (bits + 1) / 2;
287 const size_t q_bits = bits - p_bits;
288
289 do
290 {
291 // TODO could generate primes in thread pool
292 p = generate_rsa_prime(rng, rng, p_bits, e);
293 q = generate_rsa_prime(rng, rng, q_bits, e);
294 n = p * q;
295 } while(n.bits() != bits);
296
297 const BigInt p_minus_1 = p - 1;
298 const BigInt q_minus_1 = q - 1;
299
300 const BigInt phi_n = lcm(p_minus_1, q_minus_1);
301 // FIXME: this uses binary ext gcd because phi_n is even
302 d = inverse_mod(e, phi_n);
303 d1 = ct_modulo(d, p_minus_1);
304 d2 = ct_modulo(d, q_minus_1);
305 c = inverse_mod(q, p); // p odd, so uses const time algorithm
306
307 RSA_PublicKey::init(std::move(n), std::move(e));
308
309 RSA_PrivateKey::init(std::move(d), std::move(p), std::move(q),
310 std::move(d1), std::move(d2), std::move(c));
311 }
312
313 /*
314 * Check Private RSA Parameters
315 */
316 bool RSA_PrivateKey::check_key(RandomNumberGenerator& rng, bool strong) const
317 {
318 if(get_n() < 35 || get_n().is_even() || get_e() < 3 || get_e().is_even())
319 return false;
320
321 if(get_d() < 2 || get_p() < 3 || get_q() < 3)
322 return false;
323
324 if(get_p() * get_q() != get_n())
325 return false;
326
327 if(get_d1() != ct_modulo(get_d(), get_p() - 1))
328 return false;
329 if(get_d2() != ct_modulo(get_d(), get_q() - 1))
330 return false;
331 if(get_c() != inverse_mod(get_q(), get_p()))
332 return false;
333
334 const size_t prob = (strong) ? 128 : 12;
335
336 if(!is_prime(get_p(), rng, prob))
337 return false;
338 if(!is_prime(get_q(), rng, prob))
339 return false;
340
341 if(strong)
342 {
343 if(ct_modulo(get_e() * get_d(), lcm(get_p() - 1, get_q() - 1)) != 1)
344 return false;
345
346 return KeyPair::signature_consistency_check(rng, *this, "EMSA4(SHA-256)");
347 }
348
349 return true;
350 }
351
352 namespace {
353
354 /**
355 * RSA private (decrypt/sign) operation
356 */
357 class RSA_Private_Operation
358 {
359 protected:
360 size_t public_modulus_bits() const { return m_public->public_modulus_bits(); }
361 size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); }
362
363 explicit RSA_Private_Operation(const RSA_PrivateKey& rsa, RandomNumberGenerator& rng) :
364 m_public(rsa.public_data()),
365 m_private(rsa.private_data()),
366 m_blinder(m_public->get_n(), rng,
367 [this](const BigInt& k) { return m_public->public_op(k); },
368 [this](const BigInt& k) { return inverse_mod(k, m_public->get_n()); }),
369 m_blinding_bits(64),
370 m_max_d1_bits(m_private->m_p_bits + m_blinding_bits),
371 m_max_d2_bits(m_private->m_q_bits + m_blinding_bits)
372 {
373 }
374
375 secure_vector<uint8_t> raw_op(const uint8_t input[], size_t input_len)
376 {
377 const BigInt input_bn(input, input_len);
378 if(input_bn >= m_public->get_n())
379 throw Invalid_Argument("RSA private op - input is too large");
380
381 // TODO: This should be a function on blinder
382 // BigInt Blinder::run_blinded_function(std::function<BigInt, BigInt> fn, const BigInt& input);
383
384 const BigInt recovered = m_blinder.unblind(rsa_private_op(m_blinder.blind(input_bn)));
385 BOTAN_ASSERT(input_bn == m_public->public_op(recovered), "RSA consistency check");
386 return BigInt::encode_1363(recovered, m_public->public_modulus_bytes());
387 }
388
389 private:
390
391 BigInt rsa_private_op(const BigInt& m) const
392 {
393 /*
394 TODO
395 Consider using Montgomery reduction instead of Barrett, using
396 the "Smooth RSA-CRT" method. https://eprint.iacr.org/2007/039.pdf
397 */
398
399 static constexpr size_t powm_window = 4;
400
401 // Compute this in main thread to avoid racing on the rng
402 const BigInt d1_mask(m_blinder.rng(), m_blinding_bits);
403
404 #if defined(BOTAN_TARGET_OS_HAS_THREADS) && !defined(BOTAN_HAS_VALGRIND)
405 #define BOTAN_RSA_USE_ASYNC
406 #endif
407
408 #if defined(BOTAN_RSA_USE_ASYNC)
409 /*
410 * Precompute m.sig_words in the main thread before calling async. Otherwise
411 * the two threads race (during Modular_Reducer::reduce) and while the output
412 * is correct in both threads, helgrind warns.
413 */
414 m.sig_words();
415
416 auto future_j1 = std::async(std::launch::async, [this, &m, &d1_mask]() {
417 #endif
418 const BigInt masked_d1 = m_private->get_d1() + (d1_mask * (m_private->get_p() - 1));
419 auto powm_d1_p = monty_precompute(m_private->m_monty_p, m_private->m_mod_p.reduce(m), powm_window);
420 BigInt j1 = monty_execute(*powm_d1_p, masked_d1, m_max_d1_bits);
421
422 #if defined(BOTAN_RSA_USE_ASYNC)
423 return j1;
424 });
425 #endif
426
427 const BigInt d2_mask(m_blinder.rng(), m_blinding_bits);
428 const BigInt masked_d2 = m_private->get_d2() + (d2_mask * (m_private->get_q() - 1));
429 auto powm_d2_q = monty_precompute(m_private->m_monty_q, m_private->m_mod_q.reduce(m), powm_window);
430 const BigInt j2 = monty_execute(*powm_d2_q, masked_d2, m_max_d2_bits);
431
432 #if defined(BOTAN_RSA_USE_ASYNC)
433 BigInt j1 = future_j1.get();
434 #endif
435
436 /*
437 * To recover the final value from the CRT representation (j1,j2)
438 * we use Garner's algorithm:
439 * c = q^-1 mod p (this is precomputed)
440 * h = c*(j1-j2) mod p
441 * m = j2 + h*q
442 *
443 * We must avoid leaking if j1 >= j2 or not, as doing so allows deriving
444 * information about the secret prime. Do this by first adding p to j1,
445 * which should ensure the subtraction of j2 does not underflow. But
446 * this may still underflow if p and q are imbalanced in size.
447 */
448
449 j1 = m_private->m_mod_p.multiply(m_private->m_mod_p.reduce((m_private->get_p() + j1) - j2), m_private->get_c());
450 return mul_add(j1, m_private->get_q(), j2);
451 }
452
453 std::shared_ptr<const RSA_Public_Data> m_public;
454 std::shared_ptr<const RSA_Private_Data> m_private;
455
456 // XXX could the blinder starting pair be shared?
457 Blinder m_blinder;
458 const size_t m_blinding_bits;
459 const size_t m_max_d1_bits;
460 const size_t m_max_d2_bits;
461 };
462
463 class RSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA,
464 private RSA_Private_Operation
465 {
466 public:
467 size_t max_input_bits() const override { return public_modulus_bits() - 1; }
468
469 size_t signature_length() const override { return public_modulus_bytes(); }
470
471 RSA_Signature_Operation(const RSA_PrivateKey& rsa, const std::string& emsa, RandomNumberGenerator& rng) :
472 PK_Ops::Signature_with_EMSA(emsa),
473 RSA_Private_Operation(rsa, rng)
474 {
475 }
476
477 secure_vector<uint8_t> raw_sign(const uint8_t input[], size_t input_len,
478 RandomNumberGenerator&) override
479 {
480 return raw_op(input, input_len);
481 }
482 };
483
484 class RSA_Decryption_Operation final : public PK_Ops::Decryption_with_EME,
485 private RSA_Private_Operation
486 {
487 public:
488
489 RSA_Decryption_Operation(const RSA_PrivateKey& rsa, const std::string& eme, RandomNumberGenerator& rng) :
490 PK_Ops::Decryption_with_EME(eme),
491 RSA_Private_Operation(rsa, rng)
492 {
493 }
494
495 size_t plaintext_length(size_t) const override { return public_modulus_bytes(); }
496
497 secure_vector<uint8_t> raw_decrypt(const uint8_t input[], size_t input_len) override
498 {
499 return raw_op(input, input_len);
500 }
501 };
502
503 class RSA_KEM_Decryption_Operation final : public PK_Ops::KEM_Decryption_with_KDF,
504 private RSA_Private_Operation
505 {
506 public:
507
508 RSA_KEM_Decryption_Operation(const RSA_PrivateKey& key,
509 const std::string& kdf,
510 RandomNumberGenerator& rng) :
511 PK_Ops::KEM_Decryption_with_KDF(kdf),
512 RSA_Private_Operation(key, rng)
513 {}
514
515 secure_vector<uint8_t>
516 raw_kem_decrypt(const uint8_t encap_key[], size_t len) override
517 {
518 return raw_op(encap_key, len);
519 }
520 };
521
522 /**
523 * RSA public (encrypt/verify) operation
524 */
525 class RSA_Public_Operation
526 {
527 public:
528 explicit RSA_Public_Operation(const RSA_PublicKey& rsa) :
529 m_public(rsa.public_data())
530 {}
531
532 size_t get_max_input_bits() const
533 {
534 const size_t n_bits = m_public->public_modulus_bits();
535
536 /*
537 Make Coverity happy that n_bits - 1 won't underflow
538
539 5 bit minimum: smallest possible RSA key is 3*5
540 */
541 BOTAN_ASSERT_NOMSG(n_bits >= 5);
542 return n_bits - 1;
543 }
544
545 protected:
546 BigInt public_op(const BigInt& m) const
547 {
548 if(m >= m_public->get_n())
549 throw Invalid_Argument("RSA public op - input is too large");
550
551 return m_public->public_op(m);
552 }
553
554 size_t public_modulus_bytes() const { return m_public->public_modulus_bytes(); }
555
556 const BigInt& get_n() const { return m_public->get_n(); }
557
558 std::shared_ptr<const RSA_Public_Data> m_public;
559 };
560
561 class RSA_Encryption_Operation final : public PK_Ops::Encryption_with_EME,
562 private RSA_Public_Operation
563 {
564 public:
565
566 RSA_Encryption_Operation(const RSA_PublicKey& rsa, const std::string& eme) :
567 PK_Ops::Encryption_with_EME(eme),
568 RSA_Public_Operation(rsa)
569 {
570 }
571
572 size_t ciphertext_length(size_t) const override { return public_modulus_bytes(); }
573
574 size_t max_raw_input_bits() const override { return get_max_input_bits(); }
575
576 secure_vector<uint8_t> raw_encrypt(const uint8_t input[], size_t input_len,
577 RandomNumberGenerator&) override
578 {
579 BigInt input_bn(input, input_len);
580 return BigInt::encode_1363(public_op(input_bn), public_modulus_bytes());
581 }
582 };
583
584 class RSA_Verify_Operation final : public PK_Ops::Verification_with_EMSA,
585 private RSA_Public_Operation
586 {
587 public:
588
589 size_t max_input_bits() const override { return get_max_input_bits(); }
590
591 RSA_Verify_Operation(const RSA_PublicKey& rsa, const std::string& emsa) :
592 PK_Ops::Verification_with_EMSA(emsa),
593 RSA_Public_Operation(rsa)
594 {
595 }
596
597 bool with_recovery() const override { return true; }
598
599 secure_vector<uint8_t> verify_mr(const uint8_t input[], size_t input_len) override
600 {
601 BigInt input_bn(input, input_len);
602 return BigInt::encode_locked(public_op(input_bn));
603 }
604 };
605
606 class RSA_KEM_Encryption_Operation final : public PK_Ops::KEM_Encryption_with_KDF,
607 private RSA_Public_Operation
608 {
609 public:
610
611 RSA_KEM_Encryption_Operation(const RSA_PublicKey& key,
612 const std::string& kdf) :
613 PK_Ops::KEM_Encryption_with_KDF(kdf),
614 RSA_Public_Operation(key) {}
615
616 private:
617 void raw_kem_encrypt(secure_vector<uint8_t>& out_encapsulated_key,
618 secure_vector<uint8_t>& raw_shared_key,
619 Botan::RandomNumberGenerator& rng) override
620 {
621 const BigInt r = BigInt::random_integer(rng, 1, get_n());
622 const BigInt c = public_op(r);
623
624 out_encapsulated_key = BigInt::encode_locked(c);
625 raw_shared_key = BigInt::encode_locked(r);
626 }
627 };
628
629 }
630
631 std::unique_ptr<PK_Ops::Encryption>
632 RSA_PublicKey::create_encryption_op(RandomNumberGenerator& /*rng*/,
633 const std::string& params,
634 const std::string& provider) const
635 {
636 #if defined(BOTAN_HAS_OPENSSL)
637 if(provider == "openssl" || provider.empty())
638 {
639 try
640 {
641 return make_openssl_rsa_enc_op(*this, params);
642 }
643 catch(Exception& e)
644 {
645 /*
646 * If OpenSSL for some reason could not handle this (eg due to OAEP params),
647 * throw if openssl was specifically requested but otherwise just fall back
648 * to the normal version.
649 */
650 if(provider == "openssl")
651 throw Lookup_Error("OpenSSL RSA provider rejected key:" + std::string(e.what()));
652 }
653 }
654 #endif
655
656 if(provider == "base" || provider.empty())
657 return std::unique_ptr<PK_Ops::Encryption>(new RSA_Encryption_Operation(*this, params));
658 throw Provider_Not_Found(algo_name(), provider);
659 }
660
661 std::unique_ptr<PK_Ops::KEM_Encryption>
662 RSA_PublicKey::create_kem_encryption_op(RandomNumberGenerator& /*rng*/,
663 const std::string& params,
664 const std::string& provider) const
665 {
666 if(provider == "base" || provider.empty())
667 return std::unique_ptr<PK_Ops::KEM_Encryption>(new RSA_KEM_Encryption_Operation(*this, params));
668 throw Provider_Not_Found(algo_name(), provider);
669 }
670
671 std::unique_ptr<PK_Ops::Verification>
672 RSA_PublicKey::create_verification_op(const std::string& params,
673 const std::string& provider) const
674 {
675 #if defined(BOTAN_HAS_OPENSSL)
676 if(provider == "openssl" || provider.empty())
677 {
678 std::unique_ptr<PK_Ops::Verification> res = make_openssl_rsa_ver_op(*this, params);
679 if(res)
680 return res;
681 }
682 #endif
683
684 if(provider == "base" || provider.empty())
685 return std::unique_ptr<PK_Ops::Verification>(new RSA_Verify_Operation(*this, params));
686
687 throw Provider_Not_Found(algo_name(), provider);
688 }
689
690 std::unique_ptr<PK_Ops::Decryption>
691 RSA_PrivateKey::create_decryption_op(RandomNumberGenerator& rng,
692 const std::string& params,
693 const std::string& provider) const
694 {
695 #if defined(BOTAN_HAS_OPENSSL)
696 if(provider == "openssl" || provider.empty())
697 {
698 try
699 {
700 return make_openssl_rsa_dec_op(*this, params);
701 }
702 catch(Exception& e)
703 {
704 if(provider == "openssl")
705 throw Lookup_Error("OpenSSL RSA provider rejected key:" + std::string(e.what()));
706 }
707 }
708 #endif
709
710 if(provider == "base" || provider.empty())
711 return std::unique_ptr<PK_Ops::Decryption>(new RSA_Decryption_Operation(*this, params, rng));
712
713 throw Provider_Not_Found(algo_name(), provider);
714 }
715
716 std::unique_ptr<PK_Ops::KEM_Decryption>
717 RSA_PrivateKey::create_kem_decryption_op(RandomNumberGenerator& rng,
718 const std::string& params,
719 const std::string& provider) const
720 {
721 if(provider == "base" || provider.empty())
722 return std::unique_ptr<PK_Ops::KEM_Decryption>(new RSA_KEM_Decryption_Operation(*this, params, rng));
723
724 throw Provider_Not_Found(algo_name(), provider);
725 }
726
727 std::unique_ptr<PK_Ops::Signature>
728 RSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng,
729 const std::string& params,
730 const std::string& provider) const
731 {
732 #if defined(BOTAN_HAS_OPENSSL)
733 if(provider == "openssl" || provider.empty())
734 {
735 std::unique_ptr<PK_Ops::Signature> res = make_openssl_rsa_sig_op(*this, params);
736 if(res)
737 return res;
738 }
739 #endif
740
741 if(provider == "base" || provider.empty())
742 return std::unique_ptr<PK_Ops::Signature>(new RSA_Signature_Operation(*this, params, rng));
743
744 throw Provider_Not_Found(algo_name(), provider);
745 }
746
747 }
Botan::mul_add
BigInt mul_add(const BigInt &a, const BigInt &b, const BigInt &c)
Definition: mp_numth.cpp:30
Botan::RSA_PrivateKey::create_decryption_op
std::unique_ptr< PK_Ops::Decryption > create_decryption_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:691
Botan::RSA_PrivateKey::get_p
const BigInt & get_p() const
Definition: rsa.cpp:197
Botan::if_work_factor
size_t if_work_factor(size_t bits)
Definition: workfactor.cpp:38
Botan::RSA_PublicKey::check_key
bool check_key(RandomNumberGenerator &rng, bool) const override
Definition: rsa.cpp:168
Botan::Invalid_Argument
Definition: exceptn.h:136
Botan::RSA_PublicKey::get_n
const BigInt & get_n() const
Definition: rsa.cpp:108
Botan::RSA_PublicKey::estimated_strength
size_t estimated_strength() const override
Definition: rsa.cpp:143
Botan::Exception
Definition: exceptn.h:85
Botan::BigInt
Definition: bigint.h:24
Botan::RSA_PublicKey::key_length
size_t key_length() const override
Definition: rsa.cpp:138
Botan::RSA_PublicKey::create_kem_encryption_op
std::unique_ptr< PK_Ops::KEM_Encryption > create_kem_encryption_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:662
Botan::RSA_PrivateKey::private_key_bits
secure_vector< uint8_t > private_key_bits() const override
Definition: rsa.cpp:180
Botan::RandomNumberGenerator
Definition: rng.h:24
Botan::Lookup_Error
Definition: exceptn.h:247
Botan::BER_Decoder::decode_and_check
BER_Decoder & decode_and_check(const T &expected, const std::string &error_msg)
Definition: ber_dec.h:277
m_public
std::shared_ptr< const RSA_Public_Data > m_public
Definition: rsa.cpp:453
Botan::RSA_PrivateKey::create_kem_decryption_op
std::unique_ptr< PK_Ops::KEM_Decryption > create_kem_decryption_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:717
final
int(* final)(unsigned char *, CTX *)
Definition: commoncrypto_hash.cpp:28
Botan::RSA_PublicKey::get_e
const BigInt & get_e() const
Definition: rsa.cpp:109
Botan::DER_Encoder::get_contents
secure_vector< uint8_t > get_contents()
Definition: der_enc.cpp:152
Botan::RSA_PrivateKey::private_data
std::shared_ptr< const RSA_Private_Data > private_data() const
Definition: rsa.cpp:175
std
Definition: bigint.h:1135
m_monty_p
std::shared_ptr< const Montgomery_Params > m_monty_p
Definition: dh.cpp:112
Botan::is_prime
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition: numthry.cpp:528
BOTAN_ASSERT_NOMSG
#define BOTAN_ASSERT_NOMSG(expr)
Definition: assert.h:68
Botan::ct_modulo
BigInt ct_modulo(const BigInt &x, const BigInt &y)
Definition: divide.cpp:118
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:213
Botan::BigInt::random_integer
static BigInt random_integer(RandomNumberGenerator &rng, const BigInt &min, const BigInt &max)
Definition: big_rand.cpp:45
Botan::DER_Encoder::end_cons
DER_Encoder & end_cons()
Definition: der_enc.cpp:191
Botan::BER_Decoder::decode
BER_Decoder & decode(bool &out)
Definition: ber_dec.h:170
Botan::RSA_PrivateKey::get_d2
const BigInt & get_d2() const
Definition: rsa.cpp:202
Botan::Public_Key::get_oid
virtual OID get_oid() const
Definition: pk_keys.cpp:53
m_mod_p
Modular_Reducer m_mod_p
Definition: pow_mod.cpp:109
Botan::BigInt::encode_locked
static secure_vector< uint8_t > encode_locked(const BigInt &n)
Definition: bigint.h:775
BOTAN_ASSERT
#define BOTAN_ASSERT(expr, assertion_made)
Definition: assert.h:55
Botan::Decoding_Error
Definition: exceptn.h:199
Botan::RSA_PrivateKey::get_d
const BigInt & get_d() const
Definition: rsa.cpp:199
Botan::DER_Encoder::encode
DER_Encoder & encode(bool b)
Definition: der_enc.cpp:285
Botan::BigInt::bits
size_t bits() const
Definition: bigint.cpp:288
Botan::SEQUENCE
Definition: asn1_obj.h:40
Botan::DER_Encoder
Definition: der_enc.h:23
Botan::monty_execute_vartime
BigInt monty_execute_vartime(const Montgomery_Exponentation_State &precomputed_state, const BigInt &k)
Definition: monty_exp.cpp:171
Botan::KeyPair::signature_consistency_check
bool signature_consistency_check(RandomNumberGenerator &rng, const Private_Key &private_key, const Public_Key &public_key, const std::string &padding)
Definition: keypair.cpp:49
m_max_d2_bits
const size_t m_max_d2_bits
Definition: rsa.cpp:460
Botan::secure_vector
std::vector< T, secure_allocator< T >> secure_vector
Definition: secmem.h:65
m_private
std::shared_ptr< const RSA_Private_Data > m_private
Definition: rsa.cpp:454
Botan::BER_Decoder::end_cons
BER_Decoder & end_cons()
Definition: ber_dec.cpp:300
Botan::lcm
BigInt lcm(const BigInt &a, const BigInt &b)
Definition: numthry.cpp:120
Botan::RSA_PublicKey::public_key_bits
std::vector< uint8_t > public_key_bits() const override
Definition: rsa.cpp:153
Botan::inverse_mod
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:325
m_max_d1_bits
const size_t m_max_d1_bits
Definition: rsa.cpp:459
Botan::RSA_PublicKey::algo_name
std::string algo_name() const override
Definition: rsa.h:43
m_e
BigInt m_e
Definition: pow_mod.cpp:113
Botan::PEM_Code::decode
secure_vector< uint8_t > decode(DataSource &source, std::string &label)
Definition: pem.cpp:68
Botan::BER_Decoder::start_cons
BER_Decoder start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: ber_dec.cpp:290
Botan::monty_precompute
std::shared_ptr< const Montgomery_Exponentation_State > monty_precompute(std::shared_ptr< const Montgomery_Params > params, const BigInt &g, size_t window_bits, bool const_time)
Definition: monty_exp.cpp:157
Botan
Definition: alg_id.cpp:13
Botan::RSA_PublicKey::algorithm_identifier
AlgorithmIdentifier algorithm_identifier() const override
Definition: rsa.cpp:148
Botan::RSA_PublicKey::create_verification_op
std::unique_ptr< PK_Ops::Verification > create_verification_op(const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:672
Botan::RSA_PrivateKey::get_c
const BigInt & get_c() const
Definition: rsa.cpp:200
Botan::RSA_PrivateKey::get_d1
const BigInt & get_d1() const
Definition: rsa.cpp:201
Botan::RSA_PrivateKey::RSA_PrivateKey
RSA_PrivateKey(const AlgorithmIdentifier &alg_id, const secure_vector< uint8_t > &key_bits)
Definition: rsa.cpp:211
Botan::RSA_PublicKey::RSA_PublicKey
RSA_PublicKey()=default
Botan::Exception::what
const char * what() const noexceptoverride
Definition: exceptn.h:96
m_blinder
Blinder m_blinder
Definition: rsa.cpp:457
Botan::RSA_PublicKey::m_public
std::shared_ptr< const RSA_Public_Data > m_public
Definition: rsa.h:86
Botan::RSA_PrivateKey::get_q
const BigInt & get_q() const
Definition: rsa.cpp:198
Botan::RSA_PublicKey::init
void init(BigInt &&n, BigInt &&e)
Definition: rsa.cpp:111
Botan::AlgorithmIdentifier
Definition: alg_id.h:21
Botan::DER_Encoder::start_cons
DER_Encoder & start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: der_enc.cpp:181
m_p
BigInt m_p
Definition: pow_mod.cpp:108
Botan::BigInt::encode_1363
static secure_vector< uint8_t > encode_1363(const BigInt &n, size_t bytes)
Definition: big_code.cpp:111
Botan::RSA_PublicKey::create_encryption_op
std::unique_ptr< PK_Ops::Encryption > create_encryption_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:632
Botan::AlgorithmIdentifier::USE_NULL_PARAM
Definition: alg_id.h:24
Botan::Provider_Not_Found
Definition: exceptn.h:278
Botan::BigInt::is_zero
bool is_zero() const
Definition: bigint.h:419
Botan::RSA_PrivateKey::check_key
bool check_key(RandomNumberGenerator &rng, bool) const override
Definition: rsa.cpp:316
Botan::generate_rsa_prime
BigInt generate_rsa_prime(RandomNumberGenerator &keygen_rng, RandomNumberGenerator &prime_test_rng, size_t bits, const BigInt &coprime, size_t prob)
Definition: make_prm.cpp:207
Botan::BER_Decoder
Definition: ber_dec.h:21
Botan::monty_execute
BigInt monty_execute(const Montgomery_Exponentation_State &precomputed_state, const BigInt &k, size_t max_k_bits)
Definition: monty_exp.cpp:165
m_blinding_bits
const size_t m_blinding_bits
Definition: rsa.cpp:458
Botan::RSA_PrivateKey::create_signature_op
std::unique_ptr< PK_Ops::Signature > create_signature_op(RandomNumberGenerator &rng, const std::string &params, const std::string &provider) const override
Definition: rsa.cpp:728
Botan::RSA_PublicKey::public_data
std::shared_ptr< const RSA_Public_Data > public_data() const
Definition: rsa.cpp:103