08805fe279
d, dmp1, dmq1, and iqmp have private magnitudes. This is awkward because the RSAPrivateKey serialization leaks the magnitudes. Do the best we can and fix them up before any RSA operations. This moves the piecemeal BN_MONT_CTX_set_locked into a common function where we can do more complex canonicalization on the keys. Ideally this would be done on key import, but the exposed struct (and OpenSSL 1.1.0's bad API design) mean there is no single point in time when key import is finished. Also document the constraints on RSA_set0_* functions. (These constraints aren't new. They just were never documented before.) Update-Note: If someone tried to use an invalid RSA key where d >= n, dmp1 >= p, dmq1 >= q, or iqmp >= p, this may break. Such keys would not have passed RSA_check_key, but it's possible to manually assemble keys that bypass it. Bug: 232 Change-Id: I421f883128952f892ac0cde0d224873a625f37c5 Reviewed-on: https://boringssl-review.googlesource.com/25259 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com> |
||
|---|---|---|
| .. | ||
| blinding.c | ||
| internal.h | ||
| padding.c | ||
| rsa_impl.c | ||
| rsa.c | ||