Module crypto::rsa

#include <std/crypto/rsa.h> source

RSA signatures (RFC 8017).

Verification with PKCS#1 v1.5 (RSASSA-PKCS1-v1_5) and PSS (RSASSA-PSS, MGF1 with the message hash) — what X.509 certificate chains and TLS CertificateVerify messages use — for moduli of 1024..4096 bits (see bignum.h's BN_LIMBS_MAX), and signing with a private key for TLS servers. Signing exponentiates in constant time (bignum.h's bn_mod_exp_secret, no CRT) and checks the signature with the public key before returning it.

struct RsaPublicKey k;
if (k.init_der(&spkiKey[0], keyLen) &&
    std::rsa_verify_pss(&k, DIGEST_SHA256, &hash[0], 32UL, &sig[0], sigLen)) { ... }

Hash ids are digest.h's DIGEST_*. Freestanding-safe.

Structs

RsaPublicKey
RsaPrivateKey

Functions

rsa_verify_pkcs1	RSASSA-PKCS1-v1_5 verification of 'hash' (the digest_size(alg)-byte digest of the message) against sig[0..sig_len). 1 if valid.
rsa_verify_pss	RSASSA-PSS verification, MGF1 with 'alg', salt length 'salt_len' (TLS and most certificates: the hash length). 1 if valid.
rsa_sign_pss	Signs 'hash' (digest_size(alg) bytes) into sig (key.pub.n.bytes bytes; *sig_len set). PSS uses a random salt of the hash's length from 'rng'. 1 on success.
rsa_sign_pkcs1

Macros

RSA_MAX_BYTES	4096-bit moduli
RSA_MIN_BITS