kris
/
boringssl
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
5692 Commits
12 Branches
38 MiB
Tree: 104306f587
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '104306f587'
${ noResults }
boringssl/crypto/rsa_extra/rsa_test.cc

rsa_test.cc 51 KiB
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Eliminate unnecessary includes from low-level crypto modules. Beyond generally eliminating unnecessary includes, eliminate as many includes of headers that declare/define particularly error-prone functionality like strlen, malloc, and free. crypto/err/internal.h was added to remove the dependency on openssl/thread.h from the public openssl/err.h header. The include of <stdlib.h> in openssl/mem.h was retained since it defines OPENSSL_malloc and friends as macros around the stdlib.h functions. The public x509.h, x509v3.h, and ssl.h headers were not changed in order to minimize breakage of source compatibility with external code. Change-Id: I0d264b73ad0a720587774430b2ab8f8275960329 Reviewed-on: https://boringssl-review.googlesource.com/4220 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Work around broken Estonian smart cards. Again. Estonian IDs issued between September 2014 to September 2015 are broken and use negative moduli. They last five years and are common enough that we need to work around this bug. Add parallel "buggy" versions of BN_cbs2unsigned and RSA_parse_public_key which tolerate this mistake, to align with OpenSSL's previous behavior. This code is currently hooked up to rsa_pub_decode in RSA_ASN1_METHOD so that d2i_X509 is tolerant. (This isn't a huge deal as the rest of that stack still uses the legacy ASN.1 code which is overly lenient in many other ways.) In future, when Chromium isn't using crypto/x509 and has more unified certificate handling code, we can put client certificates under a slightly different codepath, so this needn't hold for all certificates forever. Then in September 2019, when the broken Estonian certificates all expire, we can purge this codepath altogether. BUG=532048 Change-Id: Iadb245048c71dba2eec45dd066c4a6e077140751 Reviewed-on: https://boringssl-review.googlesource.com/5894 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Add a CRYPTO_library_init and static-initializer-less build option. Chromium does not like static initializers, and the CPU logic uses one to initialize CPU bits. However, the crypto library lacks an explicit initialization function, which could complicate (no compile-time errors) porting existing code which uses crypto/, but not ssl/. Add an explicit CRYPTO_library_init function, but make it a no-op by default. It only does anything (and is required) if building with BORINGSSL_NO_STATIC_INITIALIZER. Change-Id: I6933bdc3447fb382b1f87c788e5b8142d6f3fe39 Reviewed-on: https://boringssl-review.googlesource.com/1770 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Remove some easy obj.h dependencies. A lot of consumers of obj.h only want the NID values. Others didn't need it at all. This also removes some OBJ_nid2sn and OBJ_nid2ln calls in EVP error paths which isn't worth pulling a large table in for. BUG=chromium:499653 Change-Id: Id6dff578f993012e35b740a13b8e4f9c2edc0744 Reviewed-on: https://boringssl-review.googlesource.com/7563 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Move bn/ into crypto/fipsmodule/ Change-Id: I68aa4a740ee1c7f2a308a6536f408929f15b694c Reviewed-on: https://boringssl-review.googlesource.com/15647 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Move rsa/ to fipsmodule/rsa/ Change-Id: Id20d371ae7a88a91aaba7a9e23574eccb9caeb3c Reviewed-on: https://boringssl-review.googlesource.com/15849 Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Rename OPENSSL_NO_THREADS, part 1. BoringSSL depends on the platform's locking APIs to make internal global state thread-safe, including the PRNG. On some single-threaded embedded platforms, locking APIs may not exist, so this dependency may be disabled with a build flag. Doing so means the consumer promises the library will never be used in any multi-threaded address space. It causes BoringSSL to be globally thread-unsafe. Setting it inappropriately will subtly and unpredictably corrupt memory and leak secret keys. Unfortunately, folks sometimes misinterpreted OPENSSL_NO_THREADS as skipping an internal thread pool or disabling an optionally extra-thread-safe mode. This is not and has never been the case. Rename it to OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED to clarify what this option does. Update-Note: As a first step, this CL makes both OPENSSL_NO_THREADS and OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED work. A later CL will remove the old name, so migrate callers after or at the same time as picking up this CL. Change-Id: Ibe4964ae43eb7a52f08fd966fccb330c0cc11a8c Reviewed-on: https://boringssl-review.googlesource.com/32084 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Add a thread test for RSA. The business with cached Montgomery contexts is not trivial. Change-Id: I60d34ed5f55509372c82534d1c2233a4ad67ab34 Reviewed-on: https://boringssl-review.googlesource.com/29925 Reviewed-by: Adam Langley <agl@google.com>
6 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Add PWCT for RSA and ECDSA for FIPS 140-2. Since only the consumers knows whether an EC key will be used for ECDSA or ECDHE, it is part of the FIPS policy for the consumer to check the validity of the generated key before signing with it. Change-Id: Ie250f655c8fcb6a59cc7210def1e87eb958e9349 Reviewed-on: https://boringssl-review.googlesource.com/14745 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Fix check_fips for public keys and synchronize the EC and RSA versions. Change-Id: Ibebf787445578608845df8861d67cd1e65ed0b35 Reviewed-on: https://boringssl-review.googlesource.com/15004 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Re-wrap kOAEPCipherText from rsa_test. While I'm here, make them consistent with the keys. Change-Id: Ib2804dd4f18bbb3b3735fb7772fca590e0d6d624 Reviewed-on: https://boringssl-review.googlesource.com/5266 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Re-wrap kOAEPCipherText from rsa_test. While I'm here, make them consistent with the keys. Change-Id: Ib2804dd4f18bbb3b3735fb7772fca590e0d6d624 Reviewed-on: https://boringssl-review.googlesource.com/5266 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Re-wrap kOAEPCipherText from rsa_test. While I'm here, make them consistent with the keys. Change-Id: Ib2804dd4f18bbb3b3735fb7772fca590e0d6d624 Reviewed-on: https://boringssl-review.googlesource.com/5266 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Fix kTwoPrimeKey and kSixPrimeKey samples in rsa_test. They weren't valid DER. Some lengths were encoded with one more byte than necessary. Change-Id: I94c8c525ade835fdeca115af98ab7e5910d2aeb2 Reviewed-on: https://boringssl-review.googlesource.com/5265 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Multi-prime RSA support. RSA with more than two primes is specified in https://tools.ietf.org/html/rfc3447, although the idea goes back far earier than that. This change ports some of the changes in http://rt.openssl.org/Ticket/Display.html?id=3477&user=guest&pass=guest to BoringSSL—specifically those bits that are under an OpenSSL license. Change-Id: I51e8e345e2148702b8ce12e00518f6ef4683d3e1 Reviewed-on: https://boringssl-review.googlesource.com/4870 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Fix kTwoPrimeKey and kSixPrimeKey samples in rsa_test. They weren't valid DER. Some lengths were encoded with one more byte than necessary. Change-Id: I94c8c525ade835fdeca115af98ab7e5910d2aeb2 Reviewed-on: https://boringssl-review.googlesource.com/5265 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Multi-prime RSA support. RSA with more than two primes is specified in https://tools.ietf.org/html/rfc3447, although the idea goes back far earier than that. This change ports some of the changes in http://rt.openssl.org/Ticket/Display.html?id=3477&user=guest&pass=guest to BoringSSL—specifically those bits that are under an OpenSSL license. Change-Id: I51e8e345e2148702b8ce12e00518f6ef4683d3e1 Reviewed-on: https://boringssl-review.googlesource.com/4870 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Multi-prime RSA support. RSA with more than two primes is specified in https://tools.ietf.org/html/rfc3447, although the idea goes back far earier than that. This change ports some of the changes in http://rt.openssl.org/Ticket/Display.html?id=3477&user=guest&pass=guest to BoringSSL—specifically those bits that are under an OpenSSL license. Change-Id: I51e8e345e2148702b8ce12e00518f6ef4683d3e1 Reviewed-on: https://boringssl-review.googlesource.com/4870 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Work around broken Estonian smart cards. Again. Estonian IDs issued between September 2014 to September 2015 are broken and use negative moduli. They last five years and are common enough that we need to work around this bug. Add parallel "buggy" versions of BN_cbs2unsigned and RSA_parse_public_key which tolerate this mistake, to align with OpenSSL's previous behavior. This code is currently hooked up to rsa_pub_decode in RSA_ASN1_METHOD so that d2i_X509 is tolerant. (This isn't a huge deal as the rest of that stack still uses the legacy ASN.1 code which is overly lenient in many other ways.) In future, when Chromium isn't using crypto/x509 and has more unified certificate handling code, we can put client certificates under a slightly different codepath, so this needn't hold for all certificates forever. Then in September 2019, when the broken Estonian certificates all expire, we can purge this codepath altogether. BUG=532048 Change-Id: Iadb245048c71dba2eec45dd066c4a6e077140751 Reviewed-on: https://boringssl-review.googlesource.com/5894 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Refuse to parse RSA pubkeys with invalid exponents. We should reject RSA public keys with exponents of less than 3. This change also rejects even exponents, although the usefulness of such a public key is somewhat questionable. BUG=chromium:541257 Change-Id: I1499e9762ba40a7cf69155d21d55bc210cd6d273 Reviewed-on: https://boringssl-review.googlesource.com/6710 Reviewed-by: Adam Langley <agl@google.com>
8 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Switch rsa_test.cc to use the new RSA encrypt/decrypt API. Change-Id: I799e289a402612446e08f64f59e0243f164cf695 Reviewed-on: https://boringssl-review.googlesource.com/6372 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Switch rsa_test.cc to use the new RSA encrypt/decrypt API. Change-Id: I799e289a402612446e08f64f59e0243f164cf695 Reviewed-on: https://boringssl-review.googlesource.com/6372 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Switch rsa_test.cc to use the new RSA encrypt/decrypt API. Change-Id: I799e289a402612446e08f64f59e0243f164cf695 Reviewed-on: https://boringssl-review.googlesource.com/6372 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Switch rsa_test.cc to use the new RSA encrypt/decrypt API. Change-Id: I799e289a402612446e08f64f59e0243f164cf695 Reviewed-on: https://boringssl-review.googlesource.com/6372 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Switch rsa_test.cc to use the new RSA encrypt/decrypt API. Change-Id: I799e289a402612446e08f64f59e0243f164cf695 Reviewed-on: https://boringssl-review.googlesource.com/6372 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
RT 3493: fix RSA test - Pass in the right ciphertext length to ensure we're indeed testing ciphertext corruption (and not truncation). - Only test one mutation per byte to not make the test too slow. - Add a separate test for truncated ciphertexts. (Imported from upstream's 5f623eb61655688501cb1817a7ad0592299d894a.) Change-Id: I425a77668beac9d391387e3afad8d15ae387468f Reviewed-on: https://boringssl-review.googlesource.com/5945 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
RT 3493: fix RSA test - Pass in the right ciphertext length to ensure we're indeed testing ciphertext corruption (and not truncation). - Only test one mutation per byte to not make the test too slow. - Add a separate test for truncated ciphertexts. (Imported from upstream's 5f623eb61655688501cb1817a7ad0592299d894a.) Change-Id: I425a77668beac9d391387e3afad8d15ae387468f Reviewed-on: https://boringssl-review.googlesource.com/5945 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
Convert rsa_test to C++. In doing so, check for malloc failures and use scopers as appropriate. This should clear rsa_test for use with malloc tests. Also replace the SetKey macro and exploded RSA keys with a DER RSAPrivateKey structure. Much less tedious. Change-Id: I3ce092ef67e7ac2af74f509abbdf84b7f2b6d45d Reviewed-on: https://boringssl-review.googlesource.com/5043 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Unwind multiprime RSA support. FIPS is not compatible with multiprime RSA. Any multiprime RSA private keys will fail to parse after this change. Change-Id: I8d969d668bf0be4f66c66a30e56f0e7f6795f3e9 Reviewed-on: https://boringssl-review.googlesource.com/14984 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Unwind multiprime RSA support. FIPS is not compatible with multiprime RSA. Any multiprime RSA private keys will fail to parse after this change. Change-Id: I8d969d668bf0be4f66c66a30e56f0e7f6795f3e9 Reviewed-on: https://boringssl-review.googlesource.com/14984 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Multi-prime RSA support. RSA with more than two primes is specified in https://tools.ietf.org/html/rfc3447, although the idea goes back far earier than that. This change ports some of the changes in http://rt.openssl.org/Ticket/Display.html?id=3477&user=guest&pass=guest to BoringSSL—specifically those bits that are under an OpenSSL license. Change-Id: I51e8e345e2148702b8ce12e00518f6ef4683d3e1 Reviewed-on: https://boringssl-review.googlesource.com/4870 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Unwind multiprime RSA support. FIPS is not compatible with multiprime RSA. Any multiprime RSA private keys will fail to parse after this change. Change-Id: I8d969d668bf0be4f66c66a30e56f0e7f6795f3e9 Reviewed-on: https://boringssl-review.googlesource.com/14984 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Multi-prime RSA support. RSA with more than two primes is specified in https://tools.ietf.org/html/rfc3447, although the idea goes back far earier than that. This change ports some of the changes in http://rt.openssl.org/Ticket/Display.html?id=3477&user=guest&pass=guest to BoringSSL—specifically those bits that are under an OpenSSL license. Change-Id: I51e8e345e2148702b8ce12e00518f6ef4683d3e1 Reviewed-on: https://boringssl-review.googlesource.com/4870 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Add PWCT for RSA and ECDSA for FIPS 140-2. Since only the consumers knows whether an EC key will be used for ECDSA or ECDHE, it is part of the FIPS policy for the consumer to check the validity of the generated key before signing with it. Change-Id: Ie250f655c8fcb6a59cc7210def1e87eb958e9349 Reviewed-on: https://boringssl-review.googlesource.com/14745 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
Fix check_fips for public keys and synchronize the EC and RSA versions. Change-Id: Ibebf787445578608845df8861d67cd1e65ed0b35 Reviewed-on: https://boringssl-review.googlesource.com/15004 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
Add PWCT for RSA and ECDSA for FIPS 140-2. Since only the consumers knows whether an EC key will be used for ECDSA or ECDHE, it is part of the FIPS policy for the consumer to check the validity of the generated key before signing with it. Change-Id: Ie250f655c8fcb6a59cc7210def1e87eb958e9349 Reviewed-on: https://boringssl-review.googlesource.com/14745 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Add FIPS-compliant key generation that calls check_fips for RSA and EC. Change-Id: Ie466b7b55bdd679c5baf2127bd8de4a5058fc3b7 Reviewed-on: https://boringssl-review.googlesource.com/16346 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Add FIPS-compliant key generation that calls check_fips for RSA and EC. Change-Id: Ie466b7b55bdd679c5baf2127bd8de4a5058fc3b7 Reviewed-on: https://boringssl-review.googlesource.com/16346 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Add FIPS-compliant key generation that calls check_fips for RSA and EC. Change-Id: Ie466b7b55bdd679c5baf2127bd8de4a5058fc3b7 Reviewed-on: https://boringssl-review.googlesource.com/16346 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Add RSA_check_key function. This is function that is available in OpenSSL too. Here it only returns zero or one and doesn't do expensive primality checks on p and q. https://code.google.com/p/chromium/issues/detail?id=396250 Change-Id: I7a173da26e06440dbb595fb717e3a620edf23576 Reviewed-on: https://boringssl-review.googlesource.com/1334 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Add RSA_check_key function. This is function that is available in OpenSSL too. Here it only returns zero or one and doesn't do expensive primality checks on p and q. https://code.google.com/p/chromium/issues/detail?id=396250 Change-Id: I7a173da26e06440dbb595fb717e3a620edf23576 Reviewed-on: https://boringssl-review.googlesource.com/1334 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Add RSA_check_fips to support public key validation checks. Change-Id: I0e00f099a17d88f56b49970e612b0911afd9661e Reviewed-on: https://boringssl-review.googlesource.com/14866 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Add RSA_check_key function. This is function that is available in OpenSSL too. Here it only returns zero or one and doesn't do expensive primality checks on p and q. https://code.google.com/p/chromium/issues/detail?id=396250 Change-Id: I7a173da26e06440dbb595fb717e3a620edf23576 Reviewed-on: https://boringssl-review.googlesource.com/1334 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Verify consistency of RSA keys after generation & parsing. Call |RSA_check_key| after parsing an RSA private key in order to verify that the key is consistent. This is consistent with ECC key parsing, which does a similar key check. Call |RSA_check_key| after key generation mostly as a way of double-checking the key generation was done correctly. A similar check was not added to |EC_KEY_generate| because |EC_KEY_generate| is used for generating ephemeral ECDH keys, and the check would be too expensive for that use. Change-Id: I5759d0d101c00711bbc30f81a3759f8bff01427c Reviewed-on: https://boringssl-review.googlesource.com/7522 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Verify consistency of RSA keys after generation & parsing. Call |RSA_check_key| after parsing an RSA private key in order to verify that the key is consistent. This is consistent with ECC key parsing, which does a similar key check. Call |RSA_check_key| after key generation mostly as a way of double-checking the key generation was done correctly. A similar check was not added to |EC_KEY_generate| because |EC_KEY_generate| is used for generating ephemeral ECDH keys, and the check would be too expensive for that use. Change-Id: I5759d0d101c00711bbc30f81a3759f8bff01427c Reviewed-on: https://boringssl-review.googlesource.com/7522 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Add RSA_check_key function. This is function that is available in OpenSSL too. Here it only returns zero or one and doesn't do expensive primality checks on p and q. https://code.google.com/p/chromium/issues/detail?id=396250 Change-Id: I7a173da26e06440dbb595fb717e3a620edf23576 Reviewed-on: https://boringssl-review.googlesource.com/1334 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
​
​
​
​
​
​
​
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Add RSA_check_key function. This is function that is available in OpenSSL too. Here it only returns zero or one and doesn't do expensive primality checks on p and q. https://code.google.com/p/chromium/issues/detail?id=396250 Change-Id: I7a173da26e06440dbb595fb717e3a620edf23576 Reviewed-on: https://boringssl-review.googlesource.com/1334 Reviewed-by: Adam Langley <agl@google.com>
10 years ago
Consistently check length in RSA_add_pkcs1_prefix. We check the length for MD5+SHA1 but not the normal cases. Instead, EVP_PKEY_sign externally checks the length (largely because the silly RSA-PSS padding function forces it). We especially should be checking the length for these because otherwise the prefix built into the ASN.1 prefix is wrong. The primary motivation is to avoid putting EVP_PKEY inside the FIPS module. This means all logic for supported algorithms should live in crypto/rsa. This requires fixing up the verify_recover logic and some tests, including bcm.c's KAT bits. (evp_tests.txt is now this odd mixture of EVP-level and RSA-level error codes. A follow-up change will add new APIs for RSA-PSS which will allow p_rsa.c to be trimmed down and make things consistent.) Change-Id: I29158e9695b28e8632b06b449234a5dded35c3e7 Reviewed-on: https://boringssl-review.googlesource.com/15824 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
Fix typo in comment. Change-Id: I0effe99d244c4ccdbb0e34db6e01a59c9463cb15 Reviewed-on: https://boringssl-review.googlesource.com/7572 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
​
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Add tests for RSA objects with only n and d. Conscrypt, thanks to Java's RSAPrivateKeySpec API, must be able to use RSA keys with only modulus and exponent. This is kind of silly and breaks the blinding code so they, both in OpenSSL and BoringSSL, had to explicitly turn blinding off. Add a test for this as we're otherwise sure to break it on accident. We may wish to avoid the silly rsa->flags modification, I'm not sure. For now, keep the requirement in so other consumers do not accidentally rely on this. (Also add a few missing ERR_clear_error calls. Functions which are expected to fail should be followed by an ERR_clear_error so later unexpected failures don't get confused.) BUG=boringssl:12 Change-Id: I674349821f1f59292b8edd085f21dc37e8bcaa75 Reviewed-on: https://boringssl-review.googlesource.com/7560 Reviewed-by: David Benjamin <davidben@google.com>
8 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Replace Scoped* heap types with bssl::UniquePtr. Unlike the Scoped* types, bssl::UniquePtr is available to C++ users, and offered for a large variety of types. The 'extern "C++"' trick is used to make the C++ bits digestible to C callers that wrap header files in 'extern "C"'. Change-Id: Ifbca4c2997d6628e33028c7d7620c72aff0f862e Reviewed-on: https://boringssl-review.googlesource.com/10521 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
8 years ago
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Work around broken Estonian smart cards. Again. Estonian IDs issued between September 2014 to September 2015 are broken and use negative moduli. They last five years and are common enough that we need to work around this bug. Add parallel "buggy" versions of BN_cbs2unsigned and RSA_parse_public_key which tolerate this mistake, to align with OpenSSL's previous behavior. This code is currently hooked up to rsa_pub_decode in RSA_ASN1_METHOD so that d2i_X509 is tolerant. (This isn't a huge deal as the rest of that stack still uses the legacy ASN.1 code which is overly lenient in many other ways.) In future, when Chromium isn't using crypto/x509 and has more unified certificate handling code, we can put client certificates under a slightly different codepath, so this needn't hold for all certificates forever. Then in September 2019, when the broken Estonian certificates all expire, we can purge this codepath altogether. BUG=532048 Change-Id: Iadb245048c71dba2eec45dd066c4a6e077140751 Reviewed-on: https://boringssl-review.googlesource.com/5894 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
Work around broken Estonian smart cards. Again. Estonian IDs issued between September 2014 to September 2015 are broken and use negative moduli. They last five years and are common enough that we need to work around this bug. Add parallel "buggy" versions of BN_cbs2unsigned and RSA_parse_public_key which tolerate this mistake, to align with OpenSSL's previous behavior. This code is currently hooked up to rsa_pub_decode in RSA_ASN1_METHOD so that d2i_X509 is tolerant. (This isn't a huge deal as the rest of that stack still uses the legacy ASN.1 code which is overly lenient in many other ways.) In future, when Chromium isn't using crypto/x509 and has more unified certificate handling code, we can put client certificates under a slightly different codepath, so this needn't hold for all certificates forever. Then in September 2019, when the broken Estonian certificates all expire, we can purge this codepath altogether. BUG=532048 Change-Id: Iadb245048c71dba2eec45dd066c4a6e077140751 Reviewed-on: https://boringssl-review.googlesource.com/5894 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
9 years ago
​
Convert rsa_test to GTest. BUG=129 Change-Id: I603054193a20c2bcc3ac1724f9b29d6384d9f62a Reviewed-on: https://boringssl-review.googlesource.com/13626 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
Refuse to parse RSA pubkeys with invalid exponents. We should reject RSA public keys with exponents of less than 3. This change also rejects even exponents, although the usefulness of such a public key is somewhat questionable. BUG=chromium:541257 Change-Id: I1499e9762ba40a7cf69155d21d55bc210cd6d273 Reviewed-on: https://boringssl-review.googlesource.com/6710 Reviewed-by: Adam Langley <agl@google.com>
8 years ago
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
10 years ago
Constrain RSA bit sizes. The FIPS RSA generation algorithm is unkind to keys with funny bit sizes. Odd numbers of bits are especially inconvenient, but the sqrt(2) bound is much simpler if the key size is a multiple of 128 (thus giving prime sizes a multiple of 64, so the sqrt(2) bound is easier to work with). Also impose a minimum RSA key size. 255-bit RSA is far too small as it is and gives small enough primes that the p-q FIPS bound (2^(n/2-100)) starts risking underflow. Change-Id: I4583c90b67385e53641ccee9b29044e79e94c920 Reviewed-on: https://boringssl-review.googlesource.com/14947 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Constrain RSA bit sizes. The FIPS RSA generation algorithm is unkind to keys with funny bit sizes. Odd numbers of bits are especially inconvenient, but the sqrt(2) bound is much simpler if the key size is a multiple of 128 (thus giving prime sizes a multiple of 64, so the sqrt(2) bound is easier to work with). Also impose a minimum RSA key size. 255-bit RSA is far too small as it is and gives small enough primes that the p-q FIPS bound (2^(n/2-100)) starts risking underflow. Change-Id: I4583c90b67385e53641ccee9b29044e79e94c920 Reviewed-on: https://boringssl-review.googlesource.com/14947 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Constrain RSA bit sizes. The FIPS RSA generation algorithm is unkind to keys with funny bit sizes. Odd numbers of bits are especially inconvenient, but the sqrt(2) bound is much simpler if the key size is a multiple of 128 (thus giving prime sizes a multiple of 64, so the sqrt(2) bound is easier to work with). Also impose a minimum RSA key size. 255-bit RSA is far too small as it is and gives small enough primes that the p-q FIPS bound (2^(n/2-100)) starts risking underflow. Change-Id: I4583c90b67385e53641ccee9b29044e79e94c920 Reviewed-on: https://boringssl-review.googlesource.com/14947 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Constrain RSA bit sizes. The FIPS RSA generation algorithm is unkind to keys with funny bit sizes. Odd numbers of bits are especially inconvenient, but the sqrt(2) bound is much simpler if the key size is a multiple of 128 (thus giving prime sizes a multiple of 64, so the sqrt(2) bound is easier to work with). Also impose a minimum RSA key size. 255-bit RSA is far too small as it is and gives small enough primes that the p-q FIPS bound (2^(n/2-100)) starts risking underflow. Change-Id: I4583c90b67385e53641ccee9b29044e79e94c920 Reviewed-on: https://boringssl-review.googlesource.com/14947 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Constrain RSA bit sizes. The FIPS RSA generation algorithm is unkind to keys with funny bit sizes. Odd numbers of bits are especially inconvenient, but the sqrt(2) bound is much simpler if the key size is a multiple of 128 (thus giving prime sizes a multiple of 64, so the sqrt(2) bound is easier to work with). Also impose a minimum RSA key size. 255-bit RSA is far too small as it is and gives small enough primes that the p-q FIPS bound (2^(n/2-100)) starts risking underflow. Change-Id: I4583c90b67385e53641ccee9b29044e79e94c920 Reviewed-on: https://boringssl-review.googlesource.com/14947 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
Align RSA key generation with FIPS 186-4. FIPS prescribes a slightly different key generation algorithm than we use. Specifically: - Rather than using BN_RAND_TOP_TWO (so using 1.5 as an upper bound for sqrt(2)), it prescribes using sqrt(2) itself. To avoid unnecessary squaring, we do a comparison against a hard-coded approximation for sqrt(2) good enough for the largest FIPS key size. I went ahead and made it constant-time since it was easy, but all this is far from constant-time. - FIPS requires a check that |p-q| is sufficiently large. - FIPS requires a check that d is sufficiently large. - BN_generate_prime_ex adds some delta to clear a table of prime numbers. FIPS does not specify any of that, so implement a separate routine here. The primality test itself will be aligned in a follow-up. For now, it is left unchanged, except that trial division is turned back on. That makes things faster and is analogous the original algorithm's delta-munging logic. Change-Id: If32f0635bfb67a8c4740dedd7781d00647bbf60b Reviewed-on: https://boringssl-review.googlesource.com/14948 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
Allow |RSA_FLAG_NO_BLINDING| to be set with |e| set. This change allows blinding to be disabled without also having to remove |e|, which would disable the CRT and the glitch checks. This is to support disabling blinding in the FIPS power-on tests. (Note: the case where |e| isn't set is tested by RSATest.OnlyDGiven.) Change-Id: I28f18beda33b1687bf145f4cbdfd37ce262dd70f Reviewed-on: https://boringssl-review.googlesource.com/17146 Commit-Queue: Adam Langley <alangley@gmail.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Don't crash when decrypting with public keys. Public and private RSA keys have the same type in OpenSSL, so it's probably prudent for us to catch this case with an error rather than crash. (As we do if you, say, configure RSA-PSS parameters on an Ed25519 EVP_PKEY.) Bindings libraries, in particular, tend to hit this sort of then when their callers do silly things. Change-Id: I2555e9bfe716a9f15273abd887a8459c682432dd Reviewed-on: https://boringssl-review.googlesource.com/17325 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Add RSA_check_key tests. Change-Id: I5ac52de4217b32631b1d455f5d693d7b2aec665f Reviewed-on: https://boringssl-review.googlesource.com/26372 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com>
6 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Check d is mostly-reduced in RSA_check_key. We don't check it is fully reduced because different implementations use Carmichael vs Euler totients, but if d exceeds n, something is wrong. Note the fixed-width BIGNUM changes already fail operations with oversized d. Update-Note: Some blatantly invalid RSA private keys will be rejected at RSA_check_key time. Note that most of those keys already are not usable with BoringSSL anyway. This CL moves the failure from sign/decrypt to RSA_check_key. Change-Id: I468dbba74a148aa58c5994cc27f549e7ae1486a2 Reviewed-on: https://boringssl-review.googlesource.com/26374 Reviewed-by: Adam Langley <alangley@gmail.com>
6 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Add RSA_check_key tests. Change-Id: I5ac52de4217b32631b1d455f5d693d7b2aec665f Reviewed-on: https://boringssl-review.googlesource.com/26372 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com>
6 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Improve the RSA key generation failure probability. The FIPS 186-4 algorithm we use includes a limit which hits a 2^-20 failure probability, assuming my math is right. We've observed roughly 2^-23. This is a little large at scale. (See b/77854769.) To avoid modifying the FIPS algorithm, retry the whole thing four times to bring the failure rate down to 2^-80. Along the way, now that I have the derivation on hand, adjust https://boringssl-review.googlesource.com/22584 to target the same failure probability. Along the way, fix an issue with RSA_generate_key where, if callers don't check for failure, there may be half a key in there. Change-Id: I0e1da98413ebd4ffa65fb74c67a58a0e0cd570ff Reviewed-on: https://boringssl-review.googlesource.com/27288 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Align RSA key generation with FIPS 186-4. FIPS prescribes a slightly different key generation algorithm than we use. Specifically: - Rather than using BN_RAND_TOP_TWO (so using 1.5 as an upper bound for sqrt(2)), it prescribes using sqrt(2) itself. To avoid unnecessary squaring, we do a comparison against a hard-coded approximation for sqrt(2) good enough for the largest FIPS key size. I went ahead and made it constant-time since it was easy, but all this is far from constant-time. - FIPS requires a check that |p-q| is sufficiently large. - FIPS requires a check that d is sufficiently large. - BN_generate_prime_ex adds some delta to clear a table of prime numbers. FIPS does not specify any of that, so implement a separate routine here. The primality test itself will be aligned in a follow-up. For now, it is left unchanged, except that trial division is turned back on. That makes things faster and is analogous the original algorithm's delta-munging logic. Change-Id: If32f0635bfb67a8c4740dedd7781d00647bbf60b Reviewed-on: https://boringssl-review.googlesource.com/14948 Reviewed-by: Adam Langley <agl@google.com>
7 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
Add a thread test for RSA. The business with cached Montgomery contexts is not trivial. Change-Id: I60d34ed5f55509372c82534d1c2233a4ad67ab34 Reviewed-on: https://boringssl-review.googlesource.com/29925 Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Rename OPENSSL_NO_THREADS, part 1. BoringSSL depends on the platform's locking APIs to make internal global state thread-safe, including the PRNG. On some single-threaded embedded platforms, locking APIs may not exist, so this dependency may be disabled with a build flag. Doing so means the consumer promises the library will never be used in any multi-threaded address space. It causes BoringSSL to be globally thread-unsafe. Setting it inappropriately will subtly and unpredictably corrupt memory and leak secret keys. Unfortunately, folks sometimes misinterpreted OPENSSL_NO_THREADS as skipping an internal thread pool or disabling an optionally extra-thread-safe mode. This is not and has never been the case. Rename it to OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED to clarify what this option does. Update-Note: As a first step, this CL makes both OPENSSL_NO_THREADS and OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED work. A later CL will remove the old name, so migrate callers after or at the same time as picking up this CL. Change-Id: Ibe4964ae43eb7a52f08fd966fccb330c0cc11a8c Reviewed-on: https://boringssl-review.googlesource.com/32084 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
6 years ago
Add a thread test for RSA. The business with cached Montgomery contexts is not trivial. Change-Id: I60d34ed5f55509372c82534d1c2233a4ad67ab34 Reviewed-on: https://boringssl-review.googlesource.com/29925 Reviewed-by: Adam Langley <agl@google.com>
6 years ago
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
​
 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119 
  1. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

  2.  * All rights reserved.

  3.  *

  4.  * This package is an SSL implementation written

  5.  * by Eric Young (eay@cryptsoft.com).

  6.  * The implementation was written so as to conform with Netscapes SSL.

  7.  *

  8.  * This library is free for commercial and non-commercial use as long as

  9.  * the following conditions are aheared to.  The following conditions

  10.  * apply to all code found in this distribution, be it the RC4, RSA,

  11.  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

  12.  * included with this distribution is covered by the same copyright terms

  13.  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

  14.  *

  15.  * Copyright remains Eric Young's, and as such any Copyright notices in

  16.  * the code are not to be removed.

  17.  * If this package is used in a product, Eric Young should be given attribution

  18.  * as the author of the parts of the library used.

  19.  * This can be in the form of a textual message at program startup or

  20.  * in documentation (online or textual) provided with the package.

  21.  *

  22.  * Redistribution and use in source and binary forms, with or without

  23.  * modification, are permitted provided that the following conditions

  24.  * are met:

  25.  * 1. Redistributions of source code must retain the copyright

  26.  *    notice, this list of conditions and the following disclaimer.

  27.  * 2. Redistributions in binary form must reproduce the above copyright

  28.  *    notice, this list of conditions and the following disclaimer in the

  29.  *    documentation and/or other materials provided with the distribution.

  30.  * 3. All advertising materials mentioning features or use of this software

  31.  *    must display the following acknowledgement:

  32.  *    "This product includes cryptographic software written by

  33.  *     Eric Young (eay@cryptsoft.com)"

  34.  *    The word 'cryptographic' can be left out if the rouines from the library

  35.  *    being used are not cryptographic related :-).

  36.  * 4. If you include any Windows specific code (or a derivative thereof) from

  37.  *    the apps directory (application code) you must include an acknowledgement:

  38.  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

  39.  *

  40.  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

  41.  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

  42.  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

  43.  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

  44.  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

  45.  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

  46.  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

  47.  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

  48.  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

  49.  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

  50.  * SUCH DAMAGE.

  51.  *

  52.  * The licence and distribution terms for any publically available version or

  53.  * derivative of this code cannot be changed.  i.e. this code cannot simply be

  54.  * copied and put under another distribution licence

  55.  * [including the GNU Public Licence.] */

  56. 

  57. #include <openssl/rsa.h>

  58. 

  59. #include <stdlib.h>

  60. #include <string.h>

  61. 

  62. #include <gtest/gtest.h>

  63. 

  64. #include <openssl/bn.h>

  65. #include <openssl/bytestring.h>

  66. #include <openssl/crypto.h>

  67. #include <openssl/err.h>

  68. #include <openssl/nid.h>

  69. 

  70. #include "../fipsmodule/bn/internal.h"

  71. #include "../fipsmodule/rsa/internal.h"

  72. #include "../internal.h"

  73. #include "../test/test_util.h"

  74. 

  75. #if defined(OPENSSL_THREADS)

  76. #include <thread>

  77. #include <vector>

  78. #endif

  79. 

  80. 

  81. // kPlaintext is a sample plaintext.

  82. static const uint8_t kPlaintext[] = "\x54\x85\x9b\x34\x2c\x49\xea\x2a";

  83. static const size_t kPlaintextLen = sizeof(kPlaintext) - 1;

  84. 

  85. // kKey1 is a DER-encoded RSAPrivateKey.

  86. static const uint8_t kKey1[] =

  87.     "\x30\x82\x01\x38\x02\x01\x00\x02\x41\x00\xaa\x36\xab\xce\x88\xac\xfd\xff"

  88.     "\x55\x52\x3c\x7f\xc4\x52\x3f\x90\xef\xa0\x0d\xf3\x77\x4a\x25\x9f\x2e\x62"

  89.     "\xb4\xc5\xd9\x9c\xb5\xad\xb3\x00\xa0\x28\x5e\x53\x01\x93\x0e\x0c\x70\xfb"

  90.     "\x68\x76\x93\x9c\xe6\x16\xce\x62\x4a\x11\xe0\x08\x6d\x34\x1e\xbc\xac\xa0"

  91.     "\xa1\xf5\x02\x01\x11\x02\x40\x0a\x03\x37\x48\x62\x64\x87\x69\x5f\x5f\x30"

  92.     "\xbc\x38\xb9\x8b\x44\xc2\xcd\x2d\xff\x43\x40\x98\xcd\x20\xd8\xa1\x38\xd0"

  93.     "\x90\xbf\x64\x79\x7c\x3f\xa7\xa2\xcd\xcb\x3c\xd1\xe0\xbd\xba\x26\x54\xb4"

  94.     "\xf9\xdf\x8e\x8a\xe5\x9d\x73\x3d\x9f\x33\xb3\x01\x62\x4a\xfd\x1d\x51\x02"

  95.     "\x21\x00\xd8\x40\xb4\x16\x66\xb4\x2e\x92\xea\x0d\xa3\xb4\x32\x04\xb5\xcf"

  96.     "\xce\x33\x52\x52\x4d\x04\x16\xa5\xa4\x41\xe7\x00\xaf\x46\x12\x0d\x02\x21"

  97.     "\x00\xc9\x7f\xb1\xf0\x27\xf4\x53\xf6\x34\x12\x33\xea\xaa\xd1\xd9\x35\x3f"

  98.     "\x6c\x42\xd0\x88\x66\xb1\xd0\x5a\x0f\x20\x35\x02\x8b\x9d\x89\x02\x20\x59"

  99.     "\x0b\x95\x72\xa2\xc2\xa9\xc4\x06\x05\x9d\xc2\xab\x2f\x1d\xaf\xeb\x7e\x8b"

  100.     "\x4f\x10\xa7\x54\x9e\x8e\xed\xf5\xb4\xfc\xe0\x9e\x05\x02\x21\x00\x8e\x3c"

  101.     "\x05\x21\xfe\x15\xe0\xea\x06\xa3\x6f\xf0\xf1\x0c\x99\x52\xc3\x5b\x7a\x75"

  102.     "\x14\xfd\x32\x38\xb8\x0a\xad\x52\x98\x62\x8d\x51\x02\x20\x36\x3f\xf7\x18"

  103.     "\x9d\xa8\xe9\x0b\x1d\x34\x1f\x71\xd0\x9b\x76\xa8\xa9\x43\xe1\x1d\x10\xb2"

  104.     "\x4d\x24\x9f\x2d\xea\xfe\xf8\x0c\x18\x26";

  105. 

  106. // kFIPSKey is a DER-encoded RSAPrivateKey that is FIPS-compliant.

  107. static const uint8_t kFIPSKey[] =

  108.     "\x30\x82\x02\x5c\x02\x01\x00\x02\x81\x81\x00\xa1\x71\x90\x77\x86\x8a\xc7"

  109.     "\xb8\xfc\x2a\x45\x82\x6d\xee\xeb\x35\x3a\x18\x3f\xb6\xb0\x1e\xb1\xd3\x09"

  110.     "\x6b\x05\x4d\xec\x1c\x37\x6f\x09\x31\x32\xda\x21\x8a\x49\x0e\x16\x28\xed"

  111.     "\x9a\x30\xf3\x14\x53\xfd\x5b\xb0\xf6\x4a\x5d\x52\xe1\xda\xe1\x40\x6e\x65"

  112.     "\xbf\xca\x45\xd9\x62\x96\x4a\x1e\x11\xc4\x61\x83\x1f\x58\x8d\x5e\xd0\x12"

  113.     "\xaf\xa5\xec\x9b\x97\x2f\x6c\xb2\x82\x4a\x73\xd0\xd3\x9a\xc9\x69\x6b\x24"

  114.     "\x3c\x82\x6f\xee\x4d\x0c\x7e\xdf\xd7\xae\xea\x3a\xeb\x04\x27\x8d\x43\x81"

  115.     "\x59\xa7\x90\x56\xc1\x69\x42\xb3\xaf\x1c\x8d\x4e\xbf\x02\x03\x01\x00\x01"

  116.     "\x02\x81\x80\x60\x82\xcd\x44\x46\xcf\xeb\xf9\x6f\xf5\xad\x3b\xfd\x90\x18"

  117.     "\x57\xe7\x74\xdb\x91\xd0\xd3\x68\xa6\xaa\x38\xaa\x21\x1d\x06\xf9\x34\x8d"

  118.     "\xa0\x35\xb0\x24\xe0\xd0\x2f\x75\x9b\xdd\xfe\x91\x48\x9f\x5c\x5e\x57\x54"

  119.     "\x00\xc8\x0f\xe6\x1e\x52\x84\xd9\xc9\xa5\x55\xf4\x0a\xbe\x88\x46\x7a\xfb"

  120.     "\x18\x37\x8e\xe6\x6e\xa2\x5f\x80\x48\x34\x3f\x5c\xbe\x0e\x1e\xe8\x2f\x50"

  121.     "\xba\x14\x96\x3c\xea\xfb\xd2\x49\x33\xdc\x12\xb8\xa7\x8a\xb5\x27\xf9\x00"

  122.     "\x4b\xf5\xd2\x2a\xd0\x2c\x1d\x9b\xd5\x6c\x3e\x4b\xb9\x7e\x39\xf7\x3e\x39"

  123.     "\xc9\x47\x5e\xbe\x91\x02\x41\x00\xcd\x33\xcf\x37\x01\xd7\x59\xcc\xbe\xa0"

  124.     "\x1c\xb9\xf5\xe7\x44\x9f\x62\x91\xa7\xa7\x7b\x0c\x52\xcd\x7e\xe6\x31\x11"

  125.     "\x8b\xd8\x2c\x8a\x63\xe1\x07\xc9\xcb\xce\x01\x45\x63\xf5\x5d\x44\xfb\xeb"

  126.     "\x8d\x74\x16\x20\x7d\x3b\xb4\xa1\x61\xb0\xa8\x29\x51\xc9\xef\xb6\xa1\xd5"

  127.     "\x02\x41\x00\xc9\x68\xa6\xd3\x88\xd5\x49\x9d\x6b\x44\x96\xfd\xbf\x66\x27"

  128.     "\xb4\x1f\x90\x76\x86\x2f\xe2\xce\x20\x5d\xee\x9b\xeb\xc4\xb4\x62\x47\x79"

  129.     "\x99\xb1\x99\xbc\xa2\xa6\xb6\x96\x64\xd5\x77\x9b\x45\xd4\xf0\x99\xb5\x9e"

  130.     "\x61\x4d\xf5\x12\xdd\x84\x14\xaf\x1e\xdd\x83\x24\x43\x02\x40\x60\x29\x7f"

  131.     "\x59\xcf\xcb\x13\x92\x17\x63\x01\x13\x44\x61\x74\x8f\x1c\xaa\x15\x5f\x2f"

  132.     "\x12\xbf\x5a\xfd\xb4\xf2\x19\xbe\xe7\x37\x38\x43\x46\x19\x58\x3f\xe1\xf2"

  133.     "\x46\x8a\x69\x59\xa4\x12\x4a\x78\xa7\x86\x17\x03\x99\x0f\x34\xf1\x8a\xcf"

  134.     "\xc3\x4d\x48\xcc\xc5\x51\x61\x02\x41\x00\xc2\x12\xb3\x5d\xf5\xe5\xff\xcf"

  135.     "\x4e\x43\x83\x72\xf2\xf1\x4e\xa4\xc4\x1d\x81\xf7\xff\x40\x7e\xfa\xb5\x48"

  136.     "\x6c\xba\x1c\x8a\xec\x80\x8e\xed\xc8\x32\xa9\x8f\xd9\x30\xeb\x6e\x32\x3b"

  137.     "\xd4\x44\xcf\xd1\x1f\x6b\xe0\x37\x46\xd5\x35\xde\x79\x9d\x2c\xb9\x83\x1d"

  138.     "\x10\xdd\x02\x40\x0f\x14\x95\x96\xa0\xe2\x6c\xd4\x88\xa7\x0b\x82\x14\x10"

  139.     "\xad\x26\x0d\xe4\xa1\x5e\x01\x3d\x21\xd2\xfb\x0e\xf9\x58\xa5\xca\x1e\x21"

  140.     "\xb3\xf5\x9a\x6c\x3d\x5a\x72\xb1\x2d\xfe\xac\x09\x4f\xdd\xe5\x44\xd1\x4e"

  141.     "\xf8\x59\x85\x3a\x65\xe2\xcd\xbc\x27\x1d\x9b\x48\x9f\xb9";

  142. 

  143. static const uint8_t kFIPSPublicKey[] =

  144.     "\x30\x81\x89\x02\x81\x81\x00\xa1\x71\x90\x77\x86\x8a\xc7\xb8\xfc\x2a\x45"

  145.     "\x82\x6d\xee\xeb\x35\x3a\x18\x3f\xb6\xb0\x1e\xb1\xd3\x09\x6b\x05\x4d\xec"

  146.     "\x1c\x37\x6f\x09\x31\x32\xda\x21\x8a\x49\x0e\x16\x28\xed\x9a\x30\xf3\x14"

  147.     "\x53\xfd\x5b\xb0\xf6\x4a\x5d\x52\xe1\xda\xe1\x40\x6e\x65\xbf\xca\x45\xd9"

  148.     "\x62\x96\x4a\x1e\x11\xc4\x61\x83\x1f\x58\x8d\x5e\xd0\x12\xaf\xa5\xec\x9b"

  149.     "\x97\x2f\x6c\xb2\x82\x4a\x73\xd0\xd3\x9a\xc9\x69\x6b\x24\x3c\x82\x6f\xee"

  150.     "\x4d\x0c\x7e\xdf\xd7\xae\xea\x3a\xeb\x04\x27\x8d\x43\x81\x59\xa7\x90\x56"

  151.     "\xc1\x69\x42\xb3\xaf\x1c\x8d\x4e\xbf\x02\x03\x01\x00\x01";

  152. 

  153. // kOAEPCiphertext1 is a sample encryption of |kPlaintext| with |kKey1| using

  154. // RSA OAEP.

  155. static const uint8_t kOAEPCiphertext1[] =

  156.     "\x1b\x8f\x05\xf9\xca\x1a\x79\x52\x6e\x53\xf3\xcc\x51\x4f\xdb\x89\x2b\xfb"

  157.     "\x91\x93\x23\x1e\x78\xb9\x92\xe6\x8d\x50\xa4\x80\xcb\x52\x33\x89\x5c\x74"

  158.     "\x95\x8d\x5d\x02\xab\x8c\x0f\xd0\x40\xeb\x58\x44\xb0\x05\xc3\x9e\xd8\x27"

  159.     "\x4a\x9d\xbf\xa8\x06\x71\x40\x94\x39\xd2";

  160. 

  161. // kKey2 is a DER-encoded RSAPrivateKey.

  162. static const uint8_t kKey2[] =

  163.     "\x30\x81\xfb\x02\x01\x00\x02\x33\x00\xa3\x07\x9a\x90\xdf\x0d\xfd\x72\xac"

  164.     "\x09\x0c\xcc\x2a\x78\xb8\x74\x13\x13\x3e\x40\x75\x9c\x98\xfa\xf8\x20\x4f"

  165.     "\x35\x8a\x0b\x26\x3c\x67\x70\xe7\x83\xa9\x3b\x69\x71\xb7\x37\x79\xd2\x71"

  166.     "\x7b\xe8\x34\x77\xcf\x02\x01\x03\x02\x32\x6c\xaf\xbc\x60\x94\xb3\xfe\x4c"

  167.     "\x72\xb0\xb3\x32\xc6\xfb\x25\xa2\xb7\x62\x29\x80\x4e\x68\x65\xfc\xa4\x5a"

  168.     "\x74\xdf\x0f\x8f\xb8\x41\x3b\x52\xc0\xd0\xe5\x3d\x9b\x59\x0f\xf1\x9b\xe7"

  169.     "\x9f\x49\xdd\x21\xe5\xeb\x02\x1a\x00\xcf\x20\x35\x02\x8b\x9d\x86\x98\x40"

  170.     "\xb4\x16\x66\xb4\x2e\x92\xea\x0d\xa3\xb4\x32\x04\xb5\xcf\xce\x91\x02\x1a"

  171.     "\x00\xc9\x7f\xb1\xf0\x27\xf4\x53\xf6\x34\x12\x33\xea\xaa\xd1\xd9\x35\x3f"

  172.     "\x6c\x42\xd0\x88\x66\xb1\xd0\x5f\x02\x1a\x00\x8a\x15\x78\xac\x5d\x13\xaf"

  173.     "\x10\x2b\x22\xb9\x99\xcd\x74\x61\xf1\x5e\x6d\x22\xcc\x03\x23\xdf\xdf\x0b"

  174.     "\x02\x1a\x00\x86\x55\x21\x4a\xc5\x4d\x8d\x4e\xcd\x61\x77\xf1\xc7\x36\x90"

  175.     "\xce\x2a\x48\x2c\x8b\x05\x99\xcb\xe0\x3f\x02\x1a\x00\x83\xef\xef\xb8\xa9"

  176.     "\xa4\x0d\x1d\xb6\xed\x98\xad\x84\xed\x13\x35\xdc\xc1\x08\xf3\x22\xd0\x57"

  177.     "\xcf\x8d";

  178. 

  179. // kOAEPCiphertext2 is a sample encryption of |kPlaintext| with |kKey2| using

  180. // RSA OAEP.

  181. static const uint8_t kOAEPCiphertext2[] =

  182.     "\x14\xbd\xdd\x28\xc9\x83\x35\x19\x23\x80\xe8\xe5\x49\xb1\x58\x2a\x8b\x40"

  183.     "\xb4\x48\x6d\x03\xa6\xa5\x31\x1f\x1f\xd5\xf0\xa1\x80\xe4\x17\x53\x03\x29"

  184.     "\xa9\x34\x90\x74\xb1\x52\x13\x54\x29\x08\x24\x52\x62\x51";

  185. 

  186. // kKey3 is a DER-encoded RSAPrivateKey.

  187. static const uint8_t kKey3[] =

  188.     "\x30\x82\x02\x5b\x02\x01\x00\x02\x81\x81\x00\xbb\xf8\x2f\x09\x06\x82\xce"

  189.     "\x9c\x23\x38\xac\x2b\x9d\xa8\x71\xf7\x36\x8d\x07\xee\xd4\x10\x43\xa4\x40"

  190.     "\xd6\xb6\xf0\x74\x54\xf5\x1f\xb8\xdf\xba\xaf\x03\x5c\x02\xab\x61\xea\x48"

  191.     "\xce\xeb\x6f\xcd\x48\x76\xed\x52\x0d\x60\xe1\xec\x46\x19\x71\x9d\x8a\x5b"

  192.     "\x8b\x80\x7f\xaf\xb8\xe0\xa3\xdf\xc7\x37\x72\x3e\xe6\xb4\xb7\xd9\x3a\x25"

  193.     "\x84\xee\x6a\x64\x9d\x06\x09\x53\x74\x88\x34\xb2\x45\x45\x98\x39\x4e\xe0"

  194.     "\xaa\xb1\x2d\x7b\x61\xa5\x1f\x52\x7a\x9a\x41\xf6\xc1\x68\x7f\xe2\x53\x72"

  195.     "\x98\xca\x2a\x8f\x59\x46\xf8\xe5\xfd\x09\x1d\xbd\xcb\x02\x01\x11\x02\x81"

  196.     "\x81\x00\xa5\xda\xfc\x53\x41\xfa\xf2\x89\xc4\xb9\x88\xdb\x30\xc1\xcd\xf8"

  197.     "\x3f\x31\x25\x1e\x06\x68\xb4\x27\x84\x81\x38\x01\x57\x96\x41\xb2\x94\x10"

  198.     "\xb3\xc7\x99\x8d\x6b\xc4\x65\x74\x5e\x5c\x39\x26\x69\xd6\x87\x0d\xa2\xc0"

  199.     "\x82\xa9\x39\xe3\x7f\xdc\xb8\x2e\xc9\x3e\xda\xc9\x7f\xf3\xad\x59\x50\xac"

  200.     "\xcf\xbc\x11\x1c\x76\xf1\xa9\x52\x94\x44\xe5\x6a\xaf\x68\xc5\x6c\x09\x2c"

  201.     "\xd3\x8d\xc3\xbe\xf5\xd2\x0a\x93\x99\x26\xed\x4f\x74\xa1\x3e\xdd\xfb\xe1"

  202.     "\xa1\xce\xcc\x48\x94\xaf\x94\x28\xc2\xb7\xb8\x88\x3f\xe4\x46\x3a\x4b\xc8"

  203.     "\x5b\x1c\xb3\xc1\x02\x41\x00\xee\xcf\xae\x81\xb1\xb9\xb3\xc9\x08\x81\x0b"

  204.     "\x10\xa1\xb5\x60\x01\x99\xeb\x9f\x44\xae\xf4\xfd\xa4\x93\xb8\x1a\x9e\x3d"

  205.     "\x84\xf6\x32\x12\x4e\xf0\x23\x6e\x5d\x1e\x3b\x7e\x28\xfa\xe7\xaa\x04\x0a"

  206.     "\x2d\x5b\x25\x21\x76\x45\x9d\x1f\x39\x75\x41\xba\x2a\x58\xfb\x65\x99\x02"

  207.     "\x41\x00\xc9\x7f\xb1\xf0\x27\xf4\x53\xf6\x34\x12\x33\xea\xaa\xd1\xd9\x35"

  208.     "\x3f\x6c\x42\xd0\x88\x66\xb1\xd0\x5a\x0f\x20\x35\x02\x8b\x9d\x86\x98\x40"

  209.     "\xb4\x16\x66\xb4\x2e\x92\xea\x0d\xa3\xb4\x32\x04\xb5\xcf\xce\x33\x52\x52"

  210.     "\x4d\x04\x16\xa5\xa4\x41\xe7\x00\xaf\x46\x15\x03\x02\x40\x54\x49\x4c\xa6"

  211.     "\x3e\xba\x03\x37\xe4\xe2\x40\x23\xfc\xd6\x9a\x5a\xeb\x07\xdd\xdc\x01\x83"

  212.     "\xa4\xd0\xac\x9b\x54\xb0\x51\xf2\xb1\x3e\xd9\x49\x09\x75\xea\xb7\x74\x14"

  213.     "\xff\x59\xc1\xf7\x69\x2e\x9a\x2e\x20\x2b\x38\xfc\x91\x0a\x47\x41\x74\xad"

  214.     "\xc9\x3c\x1f\x67\xc9\x81\x02\x40\x47\x1e\x02\x90\xff\x0a\xf0\x75\x03\x51"

  215.     "\xb7\xf8\x78\x86\x4c\xa9\x61\xad\xbd\x3a\x8a\x7e\x99\x1c\x5c\x05\x56\xa9"

  216.     "\x4c\x31\x46\xa7\xf9\x80\x3f\x8f\x6f\x8a\xe3\x42\xe9\x31\xfd\x8a\xe4\x7a"

  217.     "\x22\x0d\x1b\x99\xa4\x95\x84\x98\x07\xfe\x39\xf9\x24\x5a\x98\x36\xda\x3d"

  218.     "\x02\x41\x00\xb0\x6c\x4f\xda\xbb\x63\x01\x19\x8d\x26\x5b\xdb\xae\x94\x23"

  219.     "\xb3\x80\xf2\x71\xf7\x34\x53\x88\x50\x93\x07\x7f\xcd\x39\xe2\x11\x9f\xc9"

  220.     "\x86\x32\x15\x4f\x58\x83\xb1\x67\xa9\x67\xbf\x40\x2b\x4e\x9e\x2e\x0f\x96"

  221.     "\x56\xe6\x98\xea\x36\x66\xed\xfb\x25\x79\x80\x39\xf7";

  222. 

  223. // kOAEPCiphertext3 is a sample encryption of |kPlaintext| with |kKey3| using

  224. // RSA OAEP.

  225. static const uint8_t kOAEPCiphertext3[] =

  226.     "\xb8\x24\x6b\x56\xa6\xed\x58\x81\xae\xb5\x85\xd9\xa2\x5b\x2a\xd7\x90\xc4"

  227.     "\x17\xe0\x80\x68\x1b\xf1\xac\x2b\xc3\xde\xb6\x9d\x8b\xce\xf0\xc4\x36\x6f"

  228.     "\xec\x40\x0a\xf0\x52\xa7\x2e\x9b\x0e\xff\xb5\xb3\xf2\xf1\x92\xdb\xea\xca"

  229.     "\x03\xc1\x27\x40\x05\x71\x13\xbf\x1f\x06\x69\xac\x22\xe9\xf3\xa7\x85\x2e"

  230.     "\x3c\x15\xd9\x13\xca\xb0\xb8\x86\x3a\x95\xc9\x92\x94\xce\x86\x74\x21\x49"

  231.     "\x54\x61\x03\x46\xf4\xd4\x74\xb2\x6f\x7c\x48\xb4\x2e\xe6\x8e\x1f\x57\x2a"

  232.     "\x1f\xc4\x02\x6a\xc4\x56\xb4\xf5\x9f\x7b\x62\x1e\xa1\xb9\xd8\x8f\x64\x20"

  233.     "\x2f\xb1";

  234. 

  235. static const uint8_t kTwoPrimeKey[] =

  236.     "\x30\x82\x04\xa1\x02\x01\x00\x02\x82\x01\x01\x00\x93\x3a\x4f\xc9\x6a\x0a"

  237.     "\x6b\x28\x04\xfa\xb7\x05\x56\xdf\xa0\xaa\x4f\xaa\xab\x94\xa0\xa9\x25\xef"

  238.     "\xc5\x96\xd2\xd4\x66\x16\x62\x2c\x13\x7b\x91\xd0\x36\x0a\x10\x11\x6d\x7a"

  239.     "\x91\xb6\xe4\x74\x57\xc1\x3d\x7a\xbe\x24\x05\x3a\x04\x0b\x73\x91\x53\xb1"

  240.     "\x74\x10\xe1\x87\xdc\x91\x28\x9c\x1e\xe5\xf2\xb9\xfc\xa2\x48\x34\xb6\x78"

  241.     "\xed\x6d\x95\xfb\xf2\xc0\x4e\x1c\xa4\x15\x00\x3c\x8a\x68\x2b\xd6\xce\xd5"

  242.     "\xb3\x9f\x66\x02\xa7\x0d\x08\xa3\x23\x9b\xe5\x36\x96\x13\x22\xf9\x69\xa6"

  243.     "\x87\x88\x9b\x85\x3f\x83\x9c\xab\x1a\x1b\x6d\x8d\x16\xf4\x5e\xbd\xee\x4b"

  244.     "\x59\x56\xf8\x9d\x58\xcd\xd2\x83\x85\x59\x43\x84\x63\x4f\xe6\x1a\x86\x66"

  245.     "\x0d\xb5\xa0\x87\x89\xb6\x13\x82\x43\xda\x34\x92\x3b\x68\xc4\x95\x71\x2f"

  246.     "\x15\xc2\xe0\x43\x67\x3c\x08\x00\x36\x10\xc3\xb4\x46\x4c\x4e\x6e\xf5\x44"

  247.     "\xa9\x04\x44\x9d\xce\xc7\x05\x79\xee\x11\xcf\xaf\x2c\xd7\x9a\x32\xd3\xa5"

  248.     "\x30\xd4\x3a\x78\x43\x37\x74\x22\x90\x24\x04\x11\xd7\x95\x08\x52\xa4\x71"

  249.     "\x41\x68\x94\xb0\xa0\xc3\xec\x4e\xd2\xc4\x30\x71\x98\x64\x9c\xe3\x7c\x76"

  250.     "\xef\x33\xa3\x2b\xb1\x87\x63\xd2\x5c\x09\xfc\x90\x2d\x92\xf4\x57\x02\x01"

  251.     "\x03\x02\x82\x01\x00\x62\x26\xdf\xdb\x9c\x06\xf2\x1a\xad\xfc\x7a\x03\x8f"

  252.     "\x3f\xc0\x71\x8a\x71\xc7\xb8\x6b\x1b\x6e\x9f\xd9\x0f\x37\x38\x44\x0e\xec"

  253.     "\x1d\x62\x52\x61\x35\x79\x5c\x0a\xb6\x48\xfc\x61\x24\x98\x4d\x8f\xd6\x28"

  254.     "\xfc\x7e\xc2\xae\x26\xad\x5c\xf7\xb6\x37\xcb\xa2\xb5\xeb\xaf\xe8\x60\xc5"

  255.     "\xbd\x69\xee\xa1\xd1\x53\x16\xda\xcd\xce\xfb\x48\xf3\xb9\x52\xa1\xd5\x89"

  256.     "\x68\x6d\x63\x55\x7d\xb1\x9a\xc7\xe4\x89\xe3\xcd\x14\xee\xac\x6f\x5e\x05"

  257.     "\xc2\x17\xbd\x43\x79\xb9\x62\x17\x50\xf1\x19\xaf\xb0\x67\xae\x2a\x57\xbd"

  258.     "\xc7\x66\xbc\xf3\xb3\x64\xa1\xe3\x16\x74\x9e\xea\x02\x5c\xab\x94\xd8\x97"

  259.     "\x02\x42\x0c\x2c\xba\x54\xb9\xaf\xe0\x45\x93\xad\x7f\xb3\x10\x6a\x96\x50"

  260.     "\x4b\xaf\xcf\xc8\x27\x62\x2d\x83\xe9\x26\xc6\x94\xc1\xef\x5c\x8e\x06\x42"

  261.     "\x53\xe5\x56\xaf\xc2\x99\x01\xaa\x9a\x71\xbc\xe8\x21\x33\x2a\x2d\xa3\x36"

  262.     "\xac\x1b\x86\x19\xf8\xcd\x1f\x80\xa4\x26\x98\xb8\x9f\x62\x62\xd5\x1a\x7f"

  263.     "\xee\xdb\xdf\x81\xd3\x21\xdb\x33\x92\xee\xff\xe2\x2f\x32\x77\x73\x6a\x58"

  264.     "\xab\x21\xf3\xe3\xe1\xbc\x4f\x12\x72\xa6\xb5\xc2\xfb\x27\x9e\xc8\xca\xab"

  265.     "\x64\xa0\x87\x07\x9d\xef\xca\x0f\xdb\x02\x81\x81\x00\xe6\xd3\x4d\xc0\xa1"

  266.     "\x91\x0e\x62\xfd\xb0\xdd\xc6\x30\xb8\x8c\xcb\x14\xc1\x4b\x69\x30\xdd\xcd"

  267.     "\x86\x67\xcb\x37\x14\xc5\x03\xd2\xb4\x69\xab\x3d\xe5\x16\x81\x0f\xe5\x50"

  268.     "\xf4\x18\xb1\xec\xbc\x71\xe9\x80\x99\x06\xe4\xa3\xfe\x44\x84\x4a\x2d\x1e"

  269.     "\x07\x7f\x22\x70\x6d\x4f\xd4\x93\x0b\x8b\x99\xce\x1e\xab\xcd\x4c\xd2\xd3"

  270.     "\x10\x47\x5c\x09\x9f\x6d\x82\xc0\x08\x75\xe3\x3d\x83\xc2\x19\x50\x29\xec"

  271.     "\x1f\x84\x29\xcc\xf1\x56\xee\xbd\x54\x5d\xe6\x19\xdf\x0d\x1c\xa4\xbb\x0a"

  272.     "\xfe\x84\x44\x29\x1d\xf9\x5c\x80\x96\x5b\x24\xb4\xf7\x02\x1b\x02\x81\x81"

  273.     "\x00\xa3\x48\xf1\x9c\x58\xc2\x5f\x38\xfb\xd8\x12\x39\xf1\x8e\x73\xa1\xcf"

  274.     "\x78\x12\xe0\xed\x2a\xbb\xef\xac\x23\xb2\xbf\xd6\x0c\xe9\x6e\x1e\xab\xea"

  275.     "\x3f\x68\x36\xa7\x1f\xe5\xab\xe0\x86\xa5\x76\x32\x98\xdd\x75\xb5\x2b\xbc"

  276.     "\xcb\x8a\x03\x00\x7c\x2e\xca\xf8\xbc\x19\xe4\xe3\xa3\x31\xbd\x1d\x20\x2b"

  277.     "\x09\xad\x6f\x4c\xed\x48\xd4\xdf\x87\xf9\xf0\x46\xb9\x86\x4c\x4b\x71\xe7"

  278.     "\x48\x78\xdc\xed\xc7\x82\x02\x44\xd3\xa6\xb3\x10\x5f\x62\x81\xfc\xb8\xe4"

  279.     "\x0e\xf4\x1a\xdd\xab\x3f\xbc\x63\x79\x5b\x39\x69\x5e\xea\xa9\x15\xfe\x90"

  280.     "\xec\xda\x75\x02\x81\x81\x00\x99\xe2\x33\xd5\xc1\x0b\x5e\xec\xa9\x20\x93"

  281.     "\xd9\x75\xd0\x5d\xdc\xb8\x80\xdc\xf0\xcb\x3e\x89\x04\x45\x32\x24\xb8\x83"

  282.     "\x57\xe1\xcd\x9b\xc7\x7e\x98\xb9\xab\x5f\xee\x35\xf8\x10\x76\x9d\xd2\xf6"

  283.     "\x9b\xab\x10\xaf\x43\x17\xfe\xd8\x58\x31\x73\x69\x5a\x54\xc1\xa0\x48\xdf"

  284.     "\xe3\x0c\xb2\x5d\x11\x34\x14\x72\x88\xdd\xe1\xe2\x0a\xda\x3d\x5b\xbf\x9e"

  285.     "\x57\x2a\xb0\x4e\x97\x7e\x57\xd6\xbb\x8a\xc6\x9d\x6a\x58\x1b\xdd\xf6\x39"

  286.     "\xf4\x7e\x38\x3e\x99\x66\x94\xb3\x68\x6d\xd2\x07\x54\x58\x2d\x70\xbe\xa6"

  287.     "\x3d\xab\x0e\xe7\x6d\xcd\xfa\x01\x67\x02\x81\x80\x6c\xdb\x4b\xbd\x90\x81"

  288.     "\x94\xd0\xa7\xe5\x61\x7b\xf6\x5e\xf7\xc1\x34\xfa\xb7\x40\x9e\x1c\x7d\x4a"

  289.     "\x72\xc2\x77\x2a\x8e\xb3\x46\x49\x69\xc7\xf1\x7f\x9a\xcf\x1a\x15\x43\xc7"

  290.     "\xeb\x04\x6e\x4e\xcc\x65\xe8\xf9\x23\x72\x7d\xdd\x06\xac\xaa\xfd\x74\x87"

  291.     "\x50\x7d\x66\x98\x97\xc2\x21\x28\xbe\x15\x72\x06\x73\x9f\x88\x9e\x30\x8d"

  292.     "\xea\x5a\xa6\xa0\x2f\x26\x59\x88\x32\x4b\xef\x85\xa5\xe8\x9e\x85\x01\x56"

  293.     "\xd8\x8d\x19\xcc\xb5\x94\xec\x56\xa8\x7b\x42\xb4\xa2\xbc\x93\xc7\x7f\xd2"

  294.     "\xec\xfb\x92\x26\x46\x3f\x47\x1b\x63\xff\x0b\x48\x91\xa3\x02\x81\x80\x2c"

  295.     "\x4a\xb9\xa4\x46\x7b\xff\x50\x7e\xbf\x60\x47\x3b\x2b\x66\x82\xdc\x0e\x53"

  296.     "\x65\x71\xe9\xda\x2a\xb8\x32\x93\x42\xb7\xff\xea\x67\x66\xf1\xbc\x87\x28"

  297.     "\x65\x29\x79\xca\xab\x93\x56\xda\x95\xc1\x26\x44\x3d\x27\xc1\x91\xc6\x9b"

  298.     "\xd9\xec\x9d\xb7\x49\xe7\x16\xee\x99\x87\x50\x95\x81\xd4\x5c\x5b\x5a\x5d"

  299.     "\x0a\x43\xa5\xa7\x8f\x5a\x80\x49\xa0\xb7\x10\x85\xc7\xf4\x42\x34\x86\xb6"

  300.     "\x5f\x3f\x88\x9e\xc7\xf5\x59\x29\x39\x68\x48\xf2\xd7\x08\x5b\x92\x8e\x6b"

  301.     "\xea\xa5\x63\x5f\xc0\xfb\xe4\xe1\xb2\x7d\xb7\x40\xe9\x55\x06\xbf\x58\x25"

  302.     "\x6f";

  303. 

  304. static const uint8_t kTwoPrimeEncryptedMessage[] = {

  305.     0x63, 0x0a, 0x30, 0x45, 0x43, 0x11, 0x45, 0xb7, 0x99, 0x67, 0x90, 0x35,

  306.     0x37, 0x27, 0xff, 0xbc, 0xe0, 0xbf, 0xa6, 0xd1, 0x47, 0x50, 0xbb, 0x6c,

  307.     0x1c, 0xaa, 0x66, 0xf2, 0xff, 0x9d, 0x9a, 0xa6, 0xb4, 0x16, 0x63, 0xb0,

  308.     0xa1, 0x7c, 0x7c, 0x0c, 0xef, 0xb3, 0x66, 0x52, 0x42, 0xd7, 0x5e, 0xf3,

  309.     0xa4, 0x15, 0x33, 0x40, 0x43, 0xe8, 0xb1, 0xfc, 0xe0, 0x42, 0x83, 0x46,

  310.     0x28, 0xce, 0xde, 0x7b, 0x01, 0xeb, 0x28, 0x92, 0x70, 0xdf, 0x8d, 0x54,

  311.     0x9e, 0xed, 0x23, 0xb4, 0x78, 0xc3, 0xca, 0x85, 0x53, 0x48, 0xd6, 0x8a,

  312.     0x87, 0xf7, 0x69, 0xcd, 0x82, 0x8c, 0x4f, 0x5c, 0x05, 0x55, 0xa6, 0x78,

  313.     0x89, 0xab, 0x4c, 0xd8, 0xa9, 0xd6, 0xa5, 0xf4, 0x29, 0x4c, 0x23, 0xc8,

  314.     0xcf, 0xf0, 0x4c, 0x64, 0x6b, 0x4e, 0x02, 0x17, 0x69, 0xd6, 0x47, 0x83,

  315.     0x30, 0x43, 0x02, 0x29, 0xda, 0xda, 0x75, 0x3b, 0xd7, 0xa7, 0x2b, 0x31,

  316.     0xb3, 0xe9, 0x71, 0xa4, 0x41, 0xf7, 0x26, 0x9b, 0xcd, 0x23, 0xfa, 0x45,

  317.     0x3c, 0x9b, 0x7d, 0x28, 0xf7, 0xf9, 0x67, 0x04, 0xba, 0xfc, 0x46, 0x75,

  318.     0x11, 0x3c, 0xd5, 0x27, 0x43, 0x53, 0xb1, 0xb6, 0x9e, 0x18, 0xeb, 0x11,

  319.     0xb4, 0x25, 0x20, 0x30, 0x0b, 0xe0, 0x1c, 0x17, 0x36, 0x22, 0x10, 0x0f,

  320.     0x99, 0xb5, 0x50, 0x14, 0x73, 0x07, 0xf0, 0x2f, 0x5d, 0x4c, 0xe3, 0xf2,

  321.     0x86, 0xc2, 0x05, 0xc8, 0x38, 0xed, 0xeb, 0x2a, 0x4a, 0xab, 0x76, 0xe3,

  322.     0x1a, 0x75, 0x44, 0xf7, 0x6e, 0x94, 0xdc, 0x25, 0x62, 0x7e, 0x31, 0xca,

  323.     0xc2, 0x73, 0x51, 0xb5, 0x03, 0xfb, 0xf9, 0xf6, 0xb5, 0x8d, 0x4e, 0x6c,

  324.     0x21, 0x0e, 0xf9, 0x97, 0x26, 0x57, 0xf3, 0x52, 0x72, 0x07, 0xf8, 0xb4,

  325.     0xcd, 0xb4, 0x39, 0xcf, 0xbf, 0x78, 0xcc, 0xb6, 0x87, 0xf9, 0xb7, 0x8b,

  326.     0x6a, 0xce, 0x9f, 0xc8,

  327. };

  328. 

  329. // kEstonianRSAKey is an RSAPublicKey encoded with a negative modulus. See

  330. // https://crbug.com/532048.

  331. static const uint8_t kEstonianRSAKey[] = {

  332.     0x30, 0x82, 0x01, 0x09, 0x02, 0x82, 0x01, 0x00, 0x96, 0xa6, 0x2e, 0x9c,

  333.     0x4e, 0x6a, 0xc3, 0xcc, 0xcd, 0x8f, 0x70, 0xc3, 0x55, 0xbf, 0x5e, 0x9c,

  334.     0xd4, 0xf3, 0x17, 0xc3, 0x97, 0x70, 0xae, 0xdf, 0x12, 0x5c, 0x15, 0x80,

  335.     0x03, 0xef, 0x2b, 0x18, 0x9d, 0x6a, 0xcb, 0x52, 0x22, 0xc1, 0x81, 0xb8,

  336.     0x7e, 0x61, 0xe8, 0x0f, 0x79, 0x24, 0x0f, 0x82, 0x70, 0x24, 0x4e, 0x29,

  337.     0x20, 0x05, 0x54, 0xeb, 0xd4, 0xa9, 0x65, 0x59, 0xb6, 0x3c, 0x75, 0x95,

  338.     0x2f, 0x4c, 0xf6, 0x9d, 0xd1, 0xaf, 0x5f, 0x14, 0x14, 0xe7, 0x25, 0xea,

  339.     0xa5, 0x47, 0x5d, 0xc6, 0x3e, 0x28, 0x8d, 0xdc, 0x54, 0x87, 0x2a, 0x7c,

  340.     0x10, 0xe9, 0xc6, 0x76, 0x2d, 0xe7, 0x79, 0xd8, 0x0e, 0xbb, 0xa9, 0xac,

  341.     0xb5, 0x18, 0x98, 0xd6, 0x47, 0x6e, 0x06, 0x70, 0xbf, 0x9e, 0x82, 0x25,

  342.     0x95, 0x4e, 0xfd, 0x70, 0xd7, 0x73, 0x45, 0x2e, 0xc1, 0x1f, 0x7a, 0x9a,

  343.     0x9d, 0x60, 0xc0, 0x1f, 0x67, 0x06, 0x2a, 0x4e, 0x87, 0x3f, 0x19, 0x88,

  344.     0x69, 0x64, 0x4d, 0x9f, 0x75, 0xf5, 0xd3, 0x1a, 0x41, 0x3d, 0x35, 0x17,

  345.     0xb6, 0xd1, 0x44, 0x0d, 0x25, 0x8b, 0xe7, 0x94, 0x39, 0xb0, 0x7c, 0xaf,

  346.     0x3e, 0x6a, 0xfa, 0x8d, 0x90, 0x21, 0x0f, 0x8a, 0x43, 0x94, 0x37, 0x7c,

  347.     0x2a, 0x15, 0x4c, 0xa0, 0xfa, 0xa9, 0x2f, 0x21, 0xa6, 0x6f, 0x8e, 0x2f,

  348.     0x89, 0xbc, 0xbb, 0x33, 0xf8, 0x31, 0xfc, 0xdf, 0xcd, 0x68, 0x9a, 0xbc,

  349.     0x75, 0x06, 0x95, 0xf1, 0x3d, 0xef, 0xca, 0x76, 0x27, 0xd2, 0xba, 0x8e,

  350.     0x0e, 0x1c, 0x43, 0xd7, 0x70, 0xb9, 0xc6, 0x15, 0xca, 0xd5, 0x4d, 0x87,

  351.     0xb9, 0xd1, 0xae, 0xde, 0x69, 0x73, 0x00, 0x2a, 0x97, 0x51, 0x4b, 0x30,

  352.     0x01, 0xc2, 0x85, 0xd0, 0x05, 0xcc, 0x2e, 0xe8, 0xc7, 0x42, 0xe7, 0x94,

  353.     0x51, 0xe3, 0xf5, 0x19, 0x35, 0xdc, 0x57, 0x96, 0xe7, 0xd9, 0xb4, 0x49,

  354.     0x02, 0x03, 0x01, 0x00, 0x01,

  355. };

  356. 

  357. // kExponent1RSAKey is an RSAPublicKey encoded with an exponent of 1. See

  358. // https://crbug.com/541257

  359. static const uint8_t kExponent1RSAKey[] = {

  360.     0x30, 0x82, 0x01, 0x08, 0x02, 0x82, 0x01, 0x01, 0x00, 0xcf, 0x86, 0x9a,

  361.     0x7d, 0x5c, 0x9f, 0xbd, 0x33, 0xbb, 0xc2, 0xb1, 0x06, 0xa8, 0x3e, 0xc5,

  362.     0x18, 0xf3, 0x01, 0x04, 0xdd, 0x7a, 0x38, 0x0e, 0x8e, 0x8d, 0x10, 0xaa,

  363.     0xf8, 0x64, 0x49, 0x82, 0xa6, 0x16, 0x9d, 0xd9, 0xae, 0x5e, 0x7f, 0x9b,

  364.     0x53, 0xcb, 0xbb, 0x29, 0xda, 0x98, 0x47, 0x26, 0x88, 0x2e, 0x1d, 0x64,

  365.     0xb3, 0xbc, 0x7e, 0x96, 0x3a, 0xa7, 0xd6, 0x87, 0xf6, 0xf5, 0x3f, 0xa7,

  366.     0x3b, 0xd3, 0xc5, 0xd5, 0x61, 0x3c, 0x63, 0x05, 0xf9, 0xbc, 0x64, 0x1d,

  367.     0x71, 0x65, 0xf5, 0xc8, 0xe8, 0x64, 0x41, 0x35, 0x88, 0x81, 0x6b, 0x2a,

  368.     0x24, 0xbb, 0xdd, 0x9f, 0x75, 0x4f, 0xea, 0x35, 0xe5, 0x32, 0x76, 0x5a,

  369.     0x8b, 0x7a, 0xb5, 0x92, 0x65, 0x34, 0xb7, 0x88, 0x42, 0x5d, 0x41, 0x0b,

  370.     0xd1, 0x00, 0x2d, 0x43, 0x47, 0x55, 0x60, 0x3c, 0x0e, 0x60, 0x04, 0x5c,

  371.     0x88, 0x13, 0xc7, 0x42, 0x55, 0x16, 0x31, 0x32, 0x81, 0xba, 0xde, 0xa9,

  372.     0x56, 0xeb, 0xdb, 0x66, 0x7f, 0x31, 0xba, 0xe8, 0x87, 0x1a, 0xcc, 0xad,

  373.     0x90, 0x86, 0x4b, 0xa7, 0x6d, 0xd5, 0xc1, 0xb7, 0xe7, 0x67, 0x56, 0x41,

  374.     0xf7, 0x03, 0xb3, 0x09, 0x61, 0x63, 0xb5, 0xb0, 0x19, 0x7b, 0xc5, 0x91,

  375.     0xc8, 0x96, 0x5b, 0x6a, 0x80, 0xa1, 0x53, 0x0f, 0x9a, 0x47, 0xb5, 0x9a,

  376.     0x44, 0x53, 0xbd, 0x93, 0xe3, 0xe4, 0xce, 0x0c, 0x17, 0x11, 0x51, 0x1d,

  377.     0xfd, 0x6c, 0x74, 0xe4, 0xec, 0x2a, 0xce, 0x57, 0x27, 0xcc, 0x83, 0x98,

  378.     0x08, 0x32, 0x2c, 0xd5, 0x75, 0xa9, 0x27, 0xfe, 0xaa, 0x5e, 0x48, 0xc9,

  379.     0x46, 0x9a, 0x29, 0x3f, 0xe6, 0x01, 0x4d, 0x97, 0x4a, 0x70, 0xd1, 0x5d,

  380.     0xf8, 0xc0, 0x0b, 0x23, 0xcb, 0xbe, 0xf5, 0x70, 0x0b, 0xc2, 0xf2, 0xc0,

  381.     0x33, 0x9c, 0xc4, 0x8b, 0x39, 0x7e, 0x3d, 0xc6, 0x23, 0x39, 0x9a, 0x98,

  382.     0xdd, 0x02, 0x01, 0x01,

  383. };

  384. 

  385. struct RSAEncryptParam {

  386.   const uint8_t *der;

  387.   size_t der_len;

  388.   const uint8_t *oaep_ciphertext;

  389.   size_t oaep_ciphertext_len;

  390. } kRSAEncryptParams[] = {

  391.     {kKey1, sizeof(kKey1) - 1, kOAEPCiphertext1, sizeof(kOAEPCiphertext1) - 1},

  392.     {kKey2, sizeof(kKey2) - 1, kOAEPCiphertext2, sizeof(kOAEPCiphertext2) - 1},

  393.     {kKey3, sizeof(kKey3) - 1, kOAEPCiphertext3, sizeof(kOAEPCiphertext3) - 1},

  394. };

  395. 

  396. class RSAEncryptTest : public testing::TestWithParam<RSAEncryptParam> {};

  397. 

  398. TEST_P(RSAEncryptTest, TestKey) {

  399.   const auto &param = GetParam();

  400.   bssl::UniquePtr<RSA> key(

  401.       RSA_private_key_from_bytes(param.der, param.der_len));

  402.   ASSERT_TRUE(key);

  403. 

  404.   EXPECT_TRUE(RSA_check_key(key.get()));

  405. 

  406.   uint8_t ciphertext[256];

  407. 

  408.   // Test that PKCS#1 v1.5 encryption round-trips.

  409.   size_t ciphertext_len = 0;

  410.   ASSERT_TRUE(RSA_encrypt(key.get(), &ciphertext_len, ciphertext,

  411.                           sizeof(ciphertext), kPlaintext, kPlaintextLen,

  412.                           RSA_PKCS1_PADDING));

  413.   EXPECT_EQ(RSA_size(key.get()), ciphertext_len);

  414. 

  415.   uint8_t plaintext[256];

  416.   size_t plaintext_len = 0;

  417.   ASSERT_TRUE(RSA_decrypt(key.get(), &plaintext_len, plaintext,

  418.                           sizeof(plaintext), ciphertext, ciphertext_len,

  419.                           RSA_PKCS1_PADDING));

  420.   EXPECT_EQ(Bytes(kPlaintext, kPlaintextLen), Bytes(plaintext, plaintext_len));

  421. 

  422.   // Test that OAEP encryption round-trips.

  423.   ciphertext_len = 0;

  424.   ASSERT_TRUE(RSA_encrypt(key.get(), &ciphertext_len, ciphertext,

  425.                           sizeof(ciphertext), kPlaintext, kPlaintextLen,

  426.                           RSA_PKCS1_OAEP_PADDING));

  427.   EXPECT_EQ(RSA_size(key.get()), ciphertext_len);

  428. 

  429.   plaintext_len = 0;

  430.   ASSERT_TRUE(RSA_decrypt(key.get(), &plaintext_len, plaintext,

  431.                           sizeof(plaintext), ciphertext, ciphertext_len,

  432.                           RSA_PKCS1_OAEP_PADDING));

  433.   EXPECT_EQ(Bytes(kPlaintext, kPlaintextLen), Bytes(plaintext, plaintext_len));

  434. 

  435.   // |oaep_ciphertext| should decrypt to |kPlaintext|.

  436.   plaintext_len = 0;

  437.   ASSERT_TRUE(RSA_decrypt(key.get(), &plaintext_len, plaintext,

  438.                           sizeof(plaintext), param.oaep_ciphertext,

  439.                           param.oaep_ciphertext_len, RSA_PKCS1_OAEP_PADDING));

  440.   EXPECT_EQ(Bytes(kPlaintext, kPlaintextLen), Bytes(plaintext, plaintext_len));

  441. 

  442.   // Try decrypting corrupted ciphertexts.

  443.   OPENSSL_memcpy(ciphertext, param.oaep_ciphertext, param.oaep_ciphertext_len);

  444.   for (size_t i = 0; i < param.oaep_ciphertext_len; i++) {

  445.     SCOPED_TRACE(i);

  446.     ciphertext[i] ^= 1;

  447.     EXPECT_FALSE(RSA_decrypt(

  448.         key.get(), &plaintext_len, plaintext, sizeof(plaintext), ciphertext,

  449.         param.oaep_ciphertext_len, RSA_PKCS1_OAEP_PADDING));

  450.     ERR_clear_error();

  451.     ciphertext[i] ^= 1;

  452.   }

  453. 

  454.   // Test truncated ciphertexts.

  455.   for (size_t len = 0; len < param.oaep_ciphertext_len; len++) {

  456.     SCOPED_TRACE(len);

  457.     EXPECT_FALSE(RSA_decrypt(key.get(), &plaintext_len, plaintext,

  458.                              sizeof(plaintext), ciphertext, len,

  459.                              RSA_PKCS1_OAEP_PADDING));

  460.     ERR_clear_error();

  461.   }

  462. }

  463. 

  464. INSTANTIATE_TEST_CASE_P(, RSAEncryptTest, testing::ValuesIn(kRSAEncryptParams));

  465. 

  466. TEST(RSATest, TestDecrypt) {

  467.   bssl::UniquePtr<RSA> rsa(

  468.       RSA_private_key_from_bytes(kTwoPrimeKey, sizeof(kTwoPrimeKey) - 1));

  469.   ASSERT_TRUE(rsa);

  470. 

  471.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  472. 

  473.   uint8_t out[256];

  474.   size_t out_len;

  475.   ASSERT_TRUE(RSA_decrypt(

  476.       rsa.get(), &out_len, out, sizeof(out), kTwoPrimeEncryptedMessage,

  477.       sizeof(kTwoPrimeEncryptedMessage), RSA_PKCS1_PADDING));

  478.   EXPECT_EQ(Bytes("hello world"), Bytes(out, out_len));

  479. }

  480. 

  481. TEST(RSATest, CheckFIPS) {

  482.   bssl::UniquePtr<RSA> rsa(

  483.       RSA_private_key_from_bytes(kFIPSKey, sizeof(kFIPSKey) - 1));

  484.   ASSERT_TRUE(rsa);

  485.   EXPECT_TRUE(RSA_check_fips(rsa.get()));

  486. 

  487.   // Check that RSA_check_fips works on a public key.

  488.   bssl::UniquePtr<RSA> pub(

  489.       RSA_public_key_from_bytes(kFIPSPublicKey, sizeof(kFIPSPublicKey) - 1));

  490.   ASSERT_TRUE(pub);

  491.   EXPECT_TRUE(RSA_check_fips(pub.get()));

  492. }

  493. 

  494. TEST(RSATest, GenerateFIPS) {

  495.   bssl::UniquePtr<RSA> rsa(RSA_new());

  496.   ASSERT_TRUE(rsa);

  497. 

  498.   // RSA_generate_key_fips may only be used for 2048-bit and 3072-bit keys.

  499.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 512, nullptr));

  500.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 1024, nullptr));

  501.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 2047, nullptr));

  502.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 2049, nullptr));

  503.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 3071, nullptr));

  504.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 3073, nullptr));

  505.   EXPECT_FALSE(RSA_generate_key_fips(rsa.get(), 4096, nullptr));

  506.   ERR_clear_error();

  507. 

  508.   // Test that we can generate 2048-bit and 3072-bit RSA keys.

  509.   ASSERT_TRUE(RSA_generate_key_fips(rsa.get(), 2048, nullptr));

  510.   EXPECT_EQ(2048u, BN_num_bits(rsa->n));

  511. 

  512.   rsa.reset(RSA_new());

  513.   ASSERT_TRUE(rsa);

  514.   ASSERT_TRUE(RSA_generate_key_fips(rsa.get(), 3072, nullptr));

  515.   EXPECT_EQ(3072u, BN_num_bits(rsa->n));

  516. }

  517. 

  518. TEST(RSATest, BadKey) {

  519.   bssl::UniquePtr<RSA> key(RSA_new());

  520.   bssl::UniquePtr<BIGNUM> e(BN_new());

  521.   ASSERT_TRUE(key);

  522.   ASSERT_TRUE(e);

  523.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  524. 

  525.   // Generate a bad key.

  526.   ASSERT_TRUE(RSA_generate_key_ex(key.get(), 512, e.get(), nullptr));

  527.   ASSERT_TRUE(BN_add(key->p, key->p, BN_value_one()));

  528. 

  529.   // Bad keys are detected.

  530.   EXPECT_FALSE(RSA_check_key(key.get()));

  531.   EXPECT_FALSE(RSA_check_fips(key.get()));

  532. 

  533.   // Bad keys may not be parsed.

  534.   uint8_t *der;

  535.   size_t der_len;

  536.   ASSERT_TRUE(RSA_private_key_to_bytes(&der, &der_len, key.get()));

  537.   bssl::UniquePtr<uint8_t> delete_der(der);

  538.   key.reset(RSA_private_key_from_bytes(der, der_len));

  539.   EXPECT_FALSE(key);

  540. }

  541. 

  542. TEST(RSATest, OnlyDGiven) {

  543.   static const char kN[] =

  544.       "00e77bbf3889d4ef36a9a25d4d69f3f632eb4362214c74517da6d6aeaa9bd09ac42b2662"

  545.       "1cd88f3a6eb013772fc3bf9f83914b6467231c630202c35b3e5808c659";

  546.   static const char kE[] = "010001";

  547.   static const char kD[] =

  548.       "0365db9eb6d73b53b015c40cd8db4de7dd7035c68b5ac1bf786d7a4ee2cea316eaeca21a"

  549.       "73ac365e58713195f2ae9849348525ca855386b6d028e437a9495a01";

  550. 

  551.   bssl::UniquePtr<RSA> key(RSA_new());

  552.   ASSERT_TRUE(key);

  553.   ASSERT_TRUE(BN_hex2bn(&key->n, kN));

  554.   ASSERT_TRUE(BN_hex2bn(&key->e, kE));

  555.   ASSERT_TRUE(BN_hex2bn(&key->d, kD));

  556. 

  557.   // Keys with only n, e, and d are functional.

  558.   EXPECT_TRUE(RSA_check_key(key.get()));

  559. 

  560.   const uint8_t kDummyHash[32] = {0};

  561.   uint8_t buf[64];

  562.   unsigned buf_len = sizeof(buf);

  563.   ASSERT_LE(RSA_size(key.get()), sizeof(buf));

  564.   EXPECT_TRUE(RSA_sign(NID_sha256, kDummyHash, sizeof(kDummyHash), buf,

  565.                        &buf_len, key.get()));

  566.   EXPECT_TRUE(RSA_verify(NID_sha256, kDummyHash, sizeof(kDummyHash), buf,

  567.                          buf_len, key.get()));

  568. 

  569.   // Keys without the public exponent must continue to work when blinding is

  570.   // disabled to support Java's RSAPrivateKeySpec API. See

  571.   // https://bugs.chromium.org/p/boringssl/issues/detail?id=12.

  572.   bssl::UniquePtr<RSA> key2(RSA_new());

  573.   ASSERT_TRUE(key2);

  574.   ASSERT_TRUE(BN_hex2bn(&key2->n, kN));

  575.   ASSERT_TRUE(BN_hex2bn(&key2->d, kD));

  576.   key2->flags |= RSA_FLAG_NO_BLINDING;

  577. 

  578.   ASSERT_LE(RSA_size(key2.get()), sizeof(buf));

  579.   EXPECT_TRUE(RSA_sign(NID_sha256, kDummyHash, sizeof(kDummyHash), buf,

  580.                        &buf_len, key2.get()));

  581. 

  582.   // Verify the signature with |key|. |key2| has no public exponent.

  583.   EXPECT_TRUE(RSA_verify(NID_sha256, kDummyHash, sizeof(kDummyHash), buf,

  584.                          buf_len, key.get()));

  585. }

  586. 

  587. TEST(RSATest, ASN1) {

  588.   // Test that private keys may be decoded.

  589.   bssl::UniquePtr<RSA> rsa(

  590.       RSA_private_key_from_bytes(kKey1, sizeof(kKey1) - 1));

  591.   ASSERT_TRUE(rsa);

  592. 

  593.   // Test that the serialization round-trips.

  594.   uint8_t *der;

  595.   size_t der_len;

  596.   ASSERT_TRUE(RSA_private_key_to_bytes(&der, &der_len, rsa.get()));

  597.   bssl::UniquePtr<uint8_t> delete_der(der);

  598.   EXPECT_EQ(Bytes(kKey1, sizeof(kKey1) - 1), Bytes(der, der_len));

  599. 

  600.   // Test that serializing public keys works.

  601.   ASSERT_TRUE(RSA_public_key_to_bytes(&der, &der_len, rsa.get()));

  602.   delete_der.reset(der);

  603. 

  604.   // Public keys may be parsed back out.

  605.   rsa.reset(RSA_public_key_from_bytes(der, der_len));

  606.   ASSERT_TRUE(rsa);

  607.   EXPECT_FALSE(rsa->p);

  608.   EXPECT_FALSE(rsa->q);

  609. 

  610.   // Serializing the result round-trips.

  611.   uint8_t *der2;

  612.   size_t der2_len;

  613.   ASSERT_TRUE(RSA_public_key_to_bytes(&der2, &der2_len, rsa.get()));

  614.   bssl::UniquePtr<uint8_t> delete_der2(der2);

  615.   EXPECT_EQ(Bytes(der, der_len), Bytes(der2, der2_len));

  616. 

  617.   // Public keys cannot be serialized as private keys.

  618.   int ok = RSA_private_key_to_bytes(&der, &der_len, rsa.get());

  619.   if (ok) {

  620.     OPENSSL_free(der);

  621.   }

  622.   EXPECT_FALSE(ok);

  623.   ERR_clear_error();

  624. 

  625.   // Public keys with negative moduli are invalid.

  626.   rsa.reset(RSA_public_key_from_bytes(kEstonianRSAKey,

  627.                                       sizeof(kEstonianRSAKey)));

  628.   EXPECT_FALSE(rsa);

  629.   ERR_clear_error();

  630. }

  631. 

  632. TEST(RSATest, BadExponent) {

  633.   bssl::UniquePtr<RSA> rsa(

  634.       RSA_public_key_from_bytes(kExponent1RSAKey, sizeof(kExponent1RSAKey)));

  635.   EXPECT_FALSE(rsa);

  636.   ERR_clear_error();

  637. }

  638. 

  639. // Attempting to generate an excessively small key should fail.

  640. TEST(RSATest, GenerateSmallKey) {

  641.   bssl::UniquePtr<RSA> rsa(RSA_new());

  642.   ASSERT_TRUE(rsa);

  643.   bssl::UniquePtr<BIGNUM> e(BN_new());

  644.   ASSERT_TRUE(e);

  645.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  646. 

  647.   EXPECT_FALSE(RSA_generate_key_ex(rsa.get(), 255, e.get(), nullptr));

  648.   uint32_t err = ERR_get_error();

  649.   EXPECT_EQ(ERR_LIB_RSA, ERR_GET_LIB(err));

  650.   EXPECT_EQ(RSA_R_KEY_SIZE_TOO_SMALL, ERR_GET_REASON(err));

  651. }

  652. 

  653. // Attempting to generate an funny RSA key length should round down.

  654. TEST(RSATest, RoundKeyLengths) {

  655.   bssl::UniquePtr<BIGNUM> e(BN_new());

  656.   ASSERT_TRUE(e);

  657.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  658. 

  659.   bssl::UniquePtr<RSA> rsa(RSA_new());

  660.   ASSERT_TRUE(rsa);

  661.   ASSERT_TRUE(RSA_generate_key_ex(rsa.get(), 1025, e.get(), nullptr));

  662.   EXPECT_EQ(1024u, BN_num_bits(rsa->n));

  663. 

  664.   rsa.reset(RSA_new());

  665.   ASSERT_TRUE(rsa);

  666.   ASSERT_TRUE(RSA_generate_key_ex(rsa.get(), 1027, e.get(), nullptr));

  667.   EXPECT_EQ(1024u, BN_num_bits(rsa->n));

  668. 

  669.   rsa.reset(RSA_new());

  670.   ASSERT_TRUE(rsa);

  671.   ASSERT_TRUE(RSA_generate_key_ex(rsa.get(), 1151, e.get(), nullptr));

  672.   EXPECT_EQ(1024u, BN_num_bits(rsa->n));

  673. 

  674.   rsa.reset(RSA_new());

  675.   ASSERT_TRUE(rsa);

  676.   ASSERT_TRUE(RSA_generate_key_ex(rsa.get(), 1152, e.get(), nullptr));

  677.   EXPECT_EQ(1152u, BN_num_bits(rsa->n));

  678. }

  679. 

  680. TEST(RSATest, BlindingDisabled) {

  681.   bssl::UniquePtr<RSA> rsa(

  682.       RSA_private_key_from_bytes(kTwoPrimeKey, sizeof(kTwoPrimeKey) - 1));

  683.   ASSERT_TRUE(rsa);

  684. 

  685.   rsa->flags |= RSA_FLAG_NO_BLINDING;

  686. 

  687.   uint8_t sig[256];

  688.   ASSERT_GE(sizeof(sig), RSA_size(rsa.get()));

  689. 

  690.   static const uint8_t kZeros[32] = {0};

  691.   unsigned sig_len;

  692.   ASSERT_TRUE(

  693.       RSA_sign(NID_sha256, kZeros, sizeof(kZeros), sig, &sig_len, rsa.get()));

  694.   EXPECT_TRUE(

  695.       RSA_verify(NID_sha256, kZeros, sizeof(kZeros), sig, sig_len, rsa.get()));

  696. }

  697. 

  698. // Test that decrypting with a public key fails gracefully rather than crashing.

  699. TEST(RSATest, DecryptPublic) {

  700.   bssl::UniquePtr<RSA> pub(

  701.       RSA_public_key_from_bytes(kFIPSPublicKey, sizeof(kFIPSPublicKey) - 1));

  702.   ASSERT_TRUE(pub);

  703.   ASSERT_EQ(1024u / 8u, RSA_size(pub.get()));

  704. 

  705.   size_t len;

  706.   uint8_t in[1024 / 8] = {0}, out[1024 / 8];

  707.   EXPECT_FALSE(RSA_decrypt(pub.get(), &len, out, sizeof(out), in, sizeof(in),

  708.                            RSA_PKCS1_PADDING));

  709.   uint32_t err = ERR_get_error();

  710.   EXPECT_EQ(ERR_LIB_RSA, ERR_GET_LIB(err));

  711.   EXPECT_EQ(RSA_R_VALUE_MISSING, ERR_GET_REASON(err));

  712. }

  713. 

  714. TEST(RSATest, CheckKey) {

  715.   static const char kN[] =

  716.       "b5a5651bc2e15ce31d789f0984053a2ea0cf8f964a78068c45acfdf078c57fd62d5a287c"

  717.       "32f3baa879f5dfea27d7a3077c9d3a2a728368c3d90164690c3d82f660ffebc7f13fed45"

  718.       "4eb5103df943c10dc32ec60b0d9b6e307bfd7f9b943e0dc3901e42501765365f7286eff2"

  719.       "f1f728774aa6a371e108a3a7dd00d7bcd4c1a186c2865d4b370ea38cc89c0b23b318dbca"

  720.       "fbd872b4f9b833dfb2a4ca7fcc23298020044e8130bfe930adfb3e5cab8d324547adf4b2"

  721.       "ce34d7cea4298f0b613d85f2bf1df03da44aee0784a1a20a15ee0c38a0f8e84962f1f61b"

  722.       "18bd43781c7385f3c2b8e2aebd3c560b4faad208ad3938bad27ddda9ed9e933dba088021"

  723.       "2dd9e28d";

  724.   static const char kE[] = "10001";

  725.   static const char kD[] =

  726.       "fb9c6afd9568ce5ddac8e6a32bb881eb6cdd962bbc639dce5805548bf0fec2214f18ffd3"

  727.       "6a50aa520cfe4477f9507d87355a24e3ff537f9f29ccffe5730b11896ebb9142982ed0df"

  728.       "9c32ba98dddab863f3e5aa764d16ebff4500d3ee11de12fabd7aeca83c7ffa5d242b3ddc"

  729.       "ecc64bcb5220996e79249a6d3f78975dfde769710569812dee59c0f56e4650d02a939d9c"

  730.       "853e2cba9b0c2447a8757951ae9a0336dfa64c3d5476df9b20f200cfb52e3fbd2d4e3f34"

  731.       "200b1171cbac367096f23366e74592025875efb6a7e3b1dd365abb0d86f34ee65ddbfa93"

  732.       "90460da0d346833d6aa6277c0216b20073ba2f18471549c309e82d12e10714d0e0dbf146"

  733.       "6fcd1f1";

  734.   static const char kP[] =

  735.       "edbe476fe8989f3966e72a20348ec6d8e924f44e1d9fa2c3485ea8a2ffd39f68574a5cef"

  736.       "ffbb92d6764789ac0f67149127239c2027fbc55b5268a1dac6588de44e614f3bdce00f0a"

  737.       "56d138800ad772d159a583c6548e37cadbfcf1b4ebfd50d01508986a516f36ed827b94ef"

  738.       "1f9b4e233bf5762b3a903d2dfbbbce1fba30e9f1";

  739.   static const char kQ[] =

  740.       "c398518790a166dbe50498f04940d14c87ded09313fb0f69f69255c688142802ba3d4f9e"

  741.       "f9425dadc462170635593c06a332cfc5fc9e6e1c05281950a5ce3bad4fd7cc83a38bd4ad"

  742.       "6865594275af424f47c64c04af1caab2e261e95b975097c887d587dc8150df34cbeccd7d"

  743.       "0688c392d9f1c617810043c9b93b884bf6ed465d";

  744.   static const char kDMP1[] =

  745.       "b44db5d1fa7e1d6ba44e36d59be6988a132f7294f7c484e543b27e84b82e9fdbbb2feb92"

  746.       "1cc9fe0fe63e54fc07e66e63b3623f5ae7d7fb124a4a8e4de4556eaf327e7c5ff3207e67"

  747.       "a1f624ba7efe6cd6b6fd5f160034a7bd92df9fd44d919d436260556f74793b181ff867b8"

  748.       "7ea9033697978e5a349d05b9250c86c3eb2a8391";

  749.   static const char kDMQ1[] =

  750.       "7c06d9240265264927a6cba80a7b4c7c9fe77d10d669abb38083f85a24adcb55376d6b50"

  751.       "9e34241cecdb5a483889f6132b672bf31aa607a242eed3669d4cf1f08b2186f0ae431bc0"

  752.       "3de38e3f234ad7dc57e1f9103b4e0d3bd36b4cc324671968322207bd9e4e7ecb06c888e0"

  753.       "cfc4e766f646665b3f14c0e7684ac4b98ec1948d";

  754.   static const char kIQMP[] =

  755.       "2887a5cb0c1bf6710e91c25da141dad92134a927431471c2d4a8b78036026d21182990e1"

  756.       "2c1d70635f07ee551383899365a69b33d4db23e5ff7371ff4244d2c3290ce2b91ac11adc"

  757.       "a54bb61ea5e64b9423102933ea100c12dad809fbf9589515e9d28e867f6b95c2d307f792"

  758.       "cac28c6d7d23f441cb5b62798233db29b5cc0348";

  759. 

  760.   bssl::UniquePtr<RSA> rsa(RSA_new());

  761.   ASSERT_TRUE(rsa);

  762. 

  763.   // Missing n or e does not pass.

  764.   ASSERT_TRUE(BN_hex2bn(&rsa->n, kN));

  765.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  766.   ERR_clear_error();

  767. 

  768.   BN_free(rsa->n);

  769.   rsa->n = nullptr;

  770.   ASSERT_TRUE(BN_hex2bn(&rsa->e, kE));

  771.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  772.   ERR_clear_error();

  773. 

  774.   // Public keys pass.

  775.   ASSERT_TRUE(BN_hex2bn(&rsa->n, kN));

  776.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  777. 

  778.   // Configuring d also passes.

  779.   ASSERT_TRUE(BN_hex2bn(&rsa->d, kD));

  780.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  781. 

  782.   // p and q must be provided together.

  783.   ASSERT_TRUE(BN_hex2bn(&rsa->p, kP));

  784.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  785.   ERR_clear_error();

  786. 

  787.   BN_free(rsa->p);

  788.   rsa->p = nullptr;

  789.   ASSERT_TRUE(BN_hex2bn(&rsa->q, kQ));

  790.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  791.   ERR_clear_error();

  792. 

  793.   // Supplying p and q without CRT parameters passes.

  794.   ASSERT_TRUE(BN_hex2bn(&rsa->p, kP));

  795.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  796. 

  797.   // With p and q together, it is sufficient to check d against e.

  798.   ASSERT_TRUE(BN_add_word(rsa->d, 1));

  799.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  800.   ERR_clear_error();

  801. 

  802.   // Test another invalid d. p-1 is divisible by 3, so there is no valid value

  803.   // of d here if e = 111. Set d to what extended GCD would have given if it

  804.   // forgot to check the inverse existed.

  805.   static const char kDBogus[] =

  806.       "140be923edb928cf4340a08ada19f23da680ff20275a81e033825ee8605afc3bf6039b87"

  807.       "f0ddc7ea3b95f214a6fdda1064d0c66b50ac7bfe8cfe6c85d3cd217ae6f5094cd72a39e5"

  808.       "a17a9ce43eae1ba5d7d8c3fb743d8cbcb3bcd74edd0b75fcca23a0b00bcea119864c0243"

  809.       "bf9ab32b25a4d73a1e062482f538055bc2258369353647d4325aec7a28dc1a6798e85fae"

  810.       "85850558868468d60015927cb10b2a893e23aa16b1f9278d4413f64d0a3122218f9000ae"

  811.       "cd8743b8e9e50bd9de81eebc4e0230d1f4f7bffc1e6f903606afba9ee694c2b40022f171"

  812.       "a760e7c63e736e31d7c7ff8b77dc206c2a3aa5afd540073060ebb9050bddce1ff1917630"

  813.       "47fff51d";

  814.   ASSERT_TRUE(BN_set_word(rsa->e, 111));

  815.   ASSERT_TRUE(BN_hex2bn(&rsa->d, kDBogus));

  816.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  817.   ERR_clear_error();

  818.   ASSERT_TRUE(BN_hex2bn(&rsa->e, kE));

  819. 

  820.   // d computed via the Euler totient rather than the Carmichael totient is also

  821.   // acceptable.

  822.   static const char kDEuler[] =

  823.       "3d231ff6ca0ee41ea50ab62c93bcd6aa5f01bd484e643b7ff6eb94c4dd414c17a0481a1c"

  824.       "4361f94f3f4d5c42098af09a527cf0d8dc96122ae8dd29189a4011d62f2bb40625d2e85f"

  825.       "4d706fb90c2e9bc9b00a0c2a28384a4c134f6d25c62d64a08fdf3f5e89a14d3daee46fda"

  826.       "8b4a2eda87cbb2735fd47290cb37bf65150edef854a28927ce5ac36d36107711cffb8ac3"

  827.       "2b090e409bb822b117744a9aabf878b8b1998d406337ec24cee3877795061c67322ac626"

  828.       "6c675a2cefe0f85f06b4d24eb6ad8e3fae7f218f5bd8ff2fb8bf8176d8527b0dfdaf8490"

  829.       "8f9bfaf3f37dcf8aa0211311bac07b1a478c3ed8a6369e5d5fc42b2afa93f5de8f520981"

  830.       "c62bbe81";

  831.   ASSERT_TRUE(BN_hex2bn(&rsa->d, kDEuler));

  832.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  833. 

  834.   // If d is completely out of range but otherwise valid, it is rejected.

  835.   static const char kDTooLarge[] =

  836.       "f2c885128cf04101c283553617c210d8ffd14cde98dc420c3c9892b55606cbedcda24298"

  837.       "7655b3f7b9433c2c316293a1cf1a2b034f197aeec1de8d81a67d94cc902b9fce1712d5a4"

  838.       "9c257ff705725cd77338d23535d3b87c8f4cecc15a6b72641ffd81aea106839d216b5fcd"

  839.       "7d415751d27255e540dd1638a8389721e9d0807d65d24d7b8c2f60e4b2c0bf250544ce68"

  840.       "b5ddbc1463d5a4638b2816b0f033dacdc0162f329af9e4d142352521fbd2fe14af824ef3"

  841.       "1601fe843c79cc3efbcb8eafd79262bdd25e2bdf21440f774e26d88ed7df938c5cf6982d"

  842.       "e9fa635b8ca36ce5c5fbd579a53cbb0348ceae752d4bc5621c5acc922ca2082494633337"

  843.       "42e770c1";

  844.   ASSERT_TRUE(BN_hex2bn(&rsa->d, kDTooLarge));

  845.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  846.   ERR_clear_error();

  847.   ASSERT_TRUE(BN_hex2bn(&rsa->d, kD));

  848. 

  849.   // CRT value must either all be provided or all missing.

  850.   ASSERT_TRUE(BN_hex2bn(&rsa->dmp1, kDMP1));

  851.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  852.   ERR_clear_error();

  853.   BN_free(rsa->dmp1);

  854.   rsa->dmp1 = nullptr;

  855. 

  856.   ASSERT_TRUE(BN_hex2bn(&rsa->dmq1, kDMQ1));

  857.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  858.   ERR_clear_error();

  859.   BN_free(rsa->dmq1);

  860.   rsa->dmq1 = nullptr;

  861. 

  862.   ASSERT_TRUE(BN_hex2bn(&rsa->iqmp, kIQMP));

  863.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  864.   ERR_clear_error();

  865. 

  866.   // The full key is accepted.

  867.   ASSERT_TRUE(BN_hex2bn(&rsa->dmp1, kDMP1));

  868.   ASSERT_TRUE(BN_hex2bn(&rsa->dmq1, kDMQ1));

  869.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  870. 

  871.   // Incorrect CRT values are rejected.

  872.   ASSERT_TRUE(BN_add_word(rsa->dmp1, 1));

  873.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  874.   ERR_clear_error();

  875.   ASSERT_TRUE(BN_sub_word(rsa->dmp1, 1));

  876. 

  877.   ASSERT_TRUE(BN_add_word(rsa->dmq1, 1));

  878.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  879.   ERR_clear_error();

  880.   ASSERT_TRUE(BN_sub_word(rsa->dmq1, 1));

  881. 

  882.   ASSERT_TRUE(BN_add_word(rsa->iqmp, 1));

  883.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  884.   ERR_clear_error();

  885.   ASSERT_TRUE(BN_sub_word(rsa->iqmp, 1));

  886. 

  887.   // Non-reduced CRT values are rejected.

  888.   ASSERT_TRUE(BN_add(rsa->dmp1, rsa->dmp1, rsa->p));

  889.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  890.   ERR_clear_error();

  891.   ASSERT_TRUE(BN_sub(rsa->dmp1, rsa->dmp1, rsa->p));

  892. 

  893.   ASSERT_TRUE(BN_add(rsa->dmq1, rsa->dmq1, rsa->q));

  894.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  895.   ERR_clear_error();

  896.   ASSERT_TRUE(BN_sub(rsa->dmq1, rsa->dmq1, rsa->q));

  897. 

  898.   ASSERT_TRUE(BN_add(rsa->iqmp, rsa->iqmp, rsa->p));

  899.   EXPECT_FALSE(RSA_check_key(rsa.get()));

  900.   ERR_clear_error();

  901.   ASSERT_TRUE(BN_sub(rsa->iqmp, rsa->iqmp, rsa->p));

  902. }

  903. 

  904. TEST(RSATest, KeygenFail) {

  905.   bssl::UniquePtr<RSA> rsa(RSA_new());

  906.   ASSERT_TRUE(rsa);

  907. 

  908.   // Cause RSA key generation after a prime has been generated, to test that

  909.   // |rsa| is left alone.

  910.   BN_GENCB cb;

  911.   BN_GENCB_set(&cb,

  912.                [](int event, int, BN_GENCB *) -> int { return event != 3; },

  913.                nullptr);

  914. 

  915.   bssl::UniquePtr<BIGNUM> e(BN_new());

  916.   ASSERT_TRUE(e);

  917.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  918. 

  919.   // Key generation should fail.

  920.   EXPECT_FALSE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), &cb));

  921. 

  922.   // Failed key generations do not leave garbage in |rsa|.

  923.   EXPECT_FALSE(rsa->n);

  924.   EXPECT_FALSE(rsa->e);

  925.   EXPECT_FALSE(rsa->d);

  926.   EXPECT_FALSE(rsa->p);

  927.   EXPECT_FALSE(rsa->q);

  928.   EXPECT_FALSE(rsa->dmp1);

  929.   EXPECT_FALSE(rsa->dmq1);

  930.   EXPECT_FALSE(rsa->iqmp);

  931.   EXPECT_FALSE(rsa->mont_n);

  932.   EXPECT_FALSE(rsa->mont_p);

  933.   EXPECT_FALSE(rsa->mont_q);

  934.   EXPECT_FALSE(rsa->d_fixed);

  935.   EXPECT_FALSE(rsa->dmp1_fixed);

  936.   EXPECT_FALSE(rsa->dmq1_fixed);

  937.   EXPECT_FALSE(rsa->inv_small_mod_large_mont);

  938.   EXPECT_FALSE(rsa->private_key_frozen);

  939. 

  940.   // Failed key generations leave the previous contents alone.

  941.   EXPECT_TRUE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), nullptr));

  942.   uint8_t *der;

  943.   size_t der_len;

  944.   ASSERT_TRUE(RSA_private_key_to_bytes(&der, &der_len, rsa.get()));

  945.   bssl::UniquePtr<uint8_t> delete_der(der);

  946. 

  947.   EXPECT_FALSE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), &cb));

  948. 

  949.   uint8_t *der2;

  950.   size_t der2_len;

  951.   ASSERT_TRUE(RSA_private_key_to_bytes(&der2, &der2_len, rsa.get()));

  952.   bssl::UniquePtr<uint8_t> delete_der2(der2);

  953.   EXPECT_EQ(Bytes(der, der_len), Bytes(der2, der2_len));

  954. 

  955.   // Generating a key over an existing key works, despite any cached state.

  956.   EXPECT_TRUE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), nullptr));

  957.   EXPECT_TRUE(RSA_check_key(rsa.get()));

  958.   uint8_t *der3;

  959.   size_t der3_len;

  960.   ASSERT_TRUE(RSA_private_key_to_bytes(&der3, &der3_len, rsa.get()));

  961.   bssl::UniquePtr<uint8_t> delete_der3(der3);

  962.   EXPECT_NE(Bytes(der, der_len), Bytes(der3, der3_len));

  963. }

  964. 

  965. TEST(RSATest, KeygenFailOnce) {

  966.   bssl::UniquePtr<RSA> rsa(RSA_new());

  967.   ASSERT_TRUE(rsa);

  968. 

  969.   // Cause only the first iteration of RSA key generation to fail.

  970.   bool failed = false;

  971.   BN_GENCB cb;

  972.   BN_GENCB_set(&cb,

  973.                [](int event, int n, BN_GENCB *cb_ptr) -> int {

  974.                  bool *failed_ptr = static_cast<bool *>(cb_ptr->arg);

  975.                  if (*failed_ptr) {

  976.                    ADD_FAILURE() << "Callback called multiple times.";

  977.                    return 1;

  978.                  }

  979.                  *failed_ptr = true;

  980.                  return 0;

  981.                },

  982.                &failed);

  983. 

  984.   // Although key generation internally retries, the external behavior of

  985.   // |BN_GENCB| is preserved.

  986.   bssl::UniquePtr<BIGNUM> e(BN_new());

  987.   ASSERT_TRUE(e);

  988.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  989.   EXPECT_FALSE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), &cb));

  990. }

  991. 

  992. TEST(RSATest, KeygenInternalRetry) {

  993.   bssl::UniquePtr<RSA> rsa(RSA_new());

  994.   ASSERT_TRUE(rsa);

  995. 

  996.   // Simulate one internal attempt at key generation failing.

  997.   bool failed = false;

  998.   BN_GENCB cb;

  999.   BN_GENCB_set(&cb,

  1000.                [](int event, int n, BN_GENCB *cb_ptr) -> int {

  1001.                  bool *failed_ptr = static_cast<bool *>(cb_ptr->arg);

  1002.                  if (*failed_ptr) {

  1003.                    return 1;

  1004.                  }

  1005.                  *failed_ptr = true;

  1006.                  // This test does not test any public API behavior. It is just

  1007.                  // a hack to exercise the retry codepath and make sure it

  1008.                  // works.

  1009.                  OPENSSL_PUT_ERROR(RSA, RSA_R_TOO_MANY_ITERATIONS);

  1010.                  return 0;

  1011.                },

  1012.                &failed);

  1013. 

  1014.   // Key generation internally retries on RSA_R_TOO_MANY_ITERATIONS.

  1015.   bssl::UniquePtr<BIGNUM> e(BN_new());

  1016.   ASSERT_TRUE(e);

  1017.   ASSERT_TRUE(BN_set_word(e.get(), RSA_F4));

  1018.   EXPECT_TRUE(RSA_generate_key_ex(rsa.get(), 2048, e.get(), &cb));

  1019. }

  1020. 

  1021. #if !defined(BORINGSSL_SHARED_LIBRARY)

  1022. TEST(RSATest, SqrtTwo) {

  1023.   bssl::UniquePtr<BIGNUM> sqrt(BN_new()), pow2(BN_new());

  1024.   bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());

  1025.   ASSERT_TRUE(sqrt);

  1026.   ASSERT_TRUE(pow2);

  1027.   ASSERT_TRUE(ctx);

  1028. 

  1029.   size_t bits = kBoringSSLRSASqrtTwoLen * BN_BITS2;

  1030.   ASSERT_TRUE(BN_one(pow2.get()));

  1031.   ASSERT_TRUE(BN_lshift(pow2.get(), pow2.get(), 2 * bits - 1));

  1032. 

  1033.   // Check that sqrt² < pow2.

  1034.   ASSERT_TRUE(

  1035.       bn_set_words(sqrt.get(), kBoringSSLRSASqrtTwo, kBoringSSLRSASqrtTwoLen));

  1036.   ASSERT_TRUE(BN_sqr(sqrt.get(), sqrt.get(), ctx.get()));

  1037.   EXPECT_LT(BN_cmp(sqrt.get(), pow2.get()), 0);

  1038. 

  1039.   // Check that pow2 < (sqrt + 1)².

  1040.   ASSERT_TRUE(

  1041.       bn_set_words(sqrt.get(), kBoringSSLRSASqrtTwo, kBoringSSLRSASqrtTwoLen));

  1042.   ASSERT_TRUE(BN_add_word(sqrt.get(), 1));

  1043.   ASSERT_TRUE(BN_sqr(sqrt.get(), sqrt.get(), ctx.get()));

  1044.   EXPECT_LT(BN_cmp(pow2.get(), sqrt.get()), 0);

  1045. 

  1046.   // Check the kBoringSSLRSASqrtTwo is sized for a 3072-bit RSA key.

  1047.   EXPECT_EQ(3072u / 2u, bits);

  1048. }

  1049. #endif  // !BORINGSSL_SHARED_LIBRARY

  1050. 

  1051. #if defined(OPENSSL_THREADS)

  1052. TEST(RSATest, Threads) {

  1053.   bssl::UniquePtr<RSA> rsa_template(

  1054.       RSA_private_key_from_bytes(kKey1, sizeof(kKey1) - 1));

  1055.   ASSERT_TRUE(rsa_template);

  1056. 

  1057.   const uint8_t kDummyHash[32] = {0};

  1058.   uint8_t sig[256];

  1059.   unsigned sig_len = sizeof(sig);

  1060.   ASSERT_LE(RSA_size(rsa_template.get()), sizeof(sig));

  1061.   EXPECT_TRUE(RSA_sign(NID_sha256, kDummyHash, sizeof(kDummyHash), sig,

  1062.                        &sig_len, rsa_template.get()));

  1063. 

  1064.   // RSA keys may be assembled piece-meal and then used in parallel between

  1065.   // threads, which requires internal locking to create some derived properties.

  1066.   bssl::UniquePtr<RSA> rsa(RSA_new());

  1067.   rsa->n = BN_dup(rsa_template->n);

  1068.   ASSERT_TRUE(rsa->n);

  1069.   rsa->e = BN_dup(rsa_template->e);

  1070.   ASSERT_TRUE(rsa->e);

  1071.   rsa->d = BN_dup(rsa_template->d);

  1072.   ASSERT_TRUE(rsa->d);

  1073.   rsa->p = BN_dup(rsa_template->p);

  1074.   ASSERT_TRUE(rsa->p);

  1075.   rsa->q = BN_dup(rsa_template->q);

  1076.   ASSERT_TRUE(rsa->q);

  1077.   rsa->dmp1 = BN_dup(rsa_template->dmp1);

  1078.   ASSERT_TRUE(rsa->dmp1);

  1079.   rsa->dmq1 = BN_dup(rsa_template->dmq1);

  1080.   ASSERT_TRUE(rsa->dmq1);

  1081.   rsa->iqmp = BN_dup(rsa_template->iqmp);

  1082.   ASSERT_TRUE(rsa->iqmp);

  1083. 

  1084.   // Each of these operations must be safe to do concurrently on different

  1085.   // threads.

  1086.   auto raw_access = [&] { EXPECT_EQ(0, BN_cmp(rsa->d, rsa_template->d)); };

  1087.   auto getter = [&] {

  1088.     const BIGNUM *d;

  1089.     RSA_get0_key(rsa.get(), nullptr, nullptr, &d);

  1090.     EXPECT_EQ(0, BN_cmp(d, rsa_template->d));

  1091.   };

  1092.   auto sign = [&] {

  1093.     uint8_t sig2[256];

  1094.     unsigned sig2_len = sizeof(sig2);

  1095.     ASSERT_LE(RSA_size(rsa.get()), sizeof(sig2));

  1096.     EXPECT_TRUE(RSA_sign(NID_sha256, kDummyHash, sizeof(kDummyHash), sig2,

  1097.                          &sig2_len, rsa.get()));

  1098.     // RSASSA-PKCS1-v1_5 is deterministic.

  1099.     EXPECT_EQ(Bytes(sig, sig_len), Bytes(sig2, sig2_len));

  1100.   };

  1101.   auto verify = [&] {

  1102.     EXPECT_TRUE(RSA_verify(NID_sha256, kDummyHash, sizeof(kDummyHash), sig,

  1103.                            sig_len, rsa.get()));

  1104.   };

  1105. 

  1106.   std::vector<std::thread> threads;

  1107.   threads.emplace_back(raw_access);

  1108.   threads.emplace_back(raw_access);

  1109.   threads.emplace_back(getter);

  1110.   threads.emplace_back(getter);

  1111.   threads.emplace_back(sign);

  1112.   threads.emplace_back(sign);

  1113.   threads.emplace_back(verify);

  1114.   threads.emplace_back(verify);

  1115.   for (auto &thread : threads) {

  1116.     thread.join();

  1117.   }

  1118. }

  1119. #endif