rsa.h 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652
  1. /**
  2. * \file rsa.h
  3. *
  4. * \brief The RSA public-key cryptosystem
  5. *
  6. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  7. * SPDX-License-Identifier: Apache-2.0
  8. *
  9. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  10. * not use this file except in compliance with the License.
  11. * You may obtain a copy of the License at
  12. *
  13. * http://www.apache.org/licenses/LICENSE-2.0
  14. *
  15. * Unless required by applicable law or agreed to in writing, software
  16. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  17. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18. * See the License for the specific language governing permissions and
  19. * limitations under the License.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. #ifndef MBEDTLS_RSA_H
  24. #define MBEDTLS_RSA_H
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #include "bignum.h"
  31. #include "md.h"
  32. #if defined(MBEDTLS_THREADING_C)
  33. #include "threading.h"
  34. #endif
  35. /*
  36. * RSA Error codes
  37. */
  38. #define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080 /**< Bad input parameters to function. */
  39. #define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100 /**< Input data contains invalid padding and is rejected. */
  40. #define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180 /**< Something failed during generation of a key. */
  41. #define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200 /**< Key failed to pass the library's validity check. */
  42. #define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280 /**< The public key operation failed. */
  43. #define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300 /**< The private key operation failed. */
  44. #define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380 /**< The PKCS#1 verification failed. */
  45. #define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 /**< The output buffer for decryption is not large enough. */
  46. #define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480 /**< The random generator failed to generate non-zeros. */
  47. /*
  48. * RSA constants
  49. */
  50. #define MBEDTLS_RSA_PUBLIC 0
  51. #define MBEDTLS_RSA_PRIVATE 1
  52. #define MBEDTLS_RSA_PKCS_V15 0
  53. #define MBEDTLS_RSA_PKCS_V21 1
  54. #define MBEDTLS_RSA_SIGN 1
  55. #define MBEDTLS_RSA_CRYPT 2
  56. #define MBEDTLS_RSA_SALT_LEN_ANY -1
  57. /*
  58. * The above constants may be used even if the RSA module is compile out,
  59. * eg for alternative (PKCS#11) RSA implemenations in the PK layers.
  60. */
  61. #if defined(MBEDTLS_RSA_C)
  62. #ifdef __cplusplus
  63. extern "C" {
  64. #endif
  65. /**
  66. * \brief RSA context structure
  67. */
  68. typedef struct
  69. {
  70. int ver; /*!< always 0 */
  71. size_t len; /*!< size(N) in chars */
  72. mbedtls_mpi N; /*!< public modulus */
  73. mbedtls_mpi E; /*!< public exponent */
  74. mbedtls_mpi D; /*!< private exponent */
  75. mbedtls_mpi P; /*!< 1st prime factor */
  76. mbedtls_mpi Q; /*!< 2nd prime factor */
  77. mbedtls_mpi DP; /*!< D % (P - 1) */
  78. mbedtls_mpi DQ; /*!< D % (Q - 1) */
  79. mbedtls_mpi QP; /*!< 1 / (Q % P) */
  80. mbedtls_mpi RN; /*!< cached R^2 mod N */
  81. mbedtls_mpi RP; /*!< cached R^2 mod P */
  82. mbedtls_mpi RQ; /*!< cached R^2 mod Q */
  83. mbedtls_mpi Vi; /*!< cached blinding value */
  84. mbedtls_mpi Vf; /*!< cached un-blinding value */
  85. int padding; /*!< MBEDTLS_RSA_PKCS_V15 for 1.5 padding and
  86. RSA_PKCS_v21 for OAEP/PSS */
  87. int hash_id; /*!< Hash identifier of mbedtls_md_type_t as
  88. specified in the mbedtls_md.h header file
  89. for the EME-OAEP and EMSA-PSS
  90. encoding */
  91. #if defined(MBEDTLS_THREADING_C)
  92. mbedtls_threading_mutex_t mutex; /*!< Thread-safety mutex */
  93. #endif
  94. }
  95. mbedtls_rsa_context;
  96. /**
  97. * \brief Initialize an RSA context
  98. *
  99. * Note: Set padding to MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP
  100. * encryption scheme and the RSASSA-PSS signature scheme.
  101. *
  102. * \param ctx RSA context to be initialized
  103. * \param padding MBEDTLS_RSA_PKCS_V15 or MBEDTLS_RSA_PKCS_V21
  104. * \param hash_id MBEDTLS_RSA_PKCS_V21 hash identifier
  105. *
  106. * \note The hash_id parameter is actually ignored
  107. * when using MBEDTLS_RSA_PKCS_V15 padding.
  108. *
  109. * \note Choice of padding mode is strictly enforced for private key
  110. * operations, since there might be security concerns in
  111. * mixing padding modes. For public key operations it's merely
  112. * a default value, which can be overriden by calling specific
  113. * rsa_rsaes_xxx or rsa_rsassa_xxx functions.
  114. *
  115. * \note The chosen hash is always used for OEAP encryption.
  116. * For PSS signatures, it's always used for making signatures,
  117. * but can be overriden (and always is, if set to
  118. * MBEDTLS_MD_NONE) for verifying them.
  119. */
  120. void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
  121. int padding,
  122. int hash_id);
  123. /**
  124. * \brief Set padding for an already initialized RSA context
  125. * See \c mbedtls_rsa_init() for details.
  126. *
  127. * \param ctx RSA context to be set
  128. * \param padding MBEDTLS_RSA_PKCS_V15 or MBEDTLS_RSA_PKCS_V21
  129. * \param hash_id MBEDTLS_RSA_PKCS_V21 hash identifier
  130. */
  131. void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id);
  132. /**
  133. * \brief Generate an RSA keypair
  134. *
  135. * \param ctx RSA context that will hold the key
  136. * \param f_rng RNG function
  137. * \param p_rng RNG parameter
  138. * \param nbits size of the public key in bits
  139. * \param exponent public exponent (e.g., 65537)
  140. *
  141. * \note mbedtls_rsa_init() must be called beforehand to setup
  142. * the RSA context.
  143. *
  144. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  145. */
  146. int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
  147. int (*f_rng)(void *, unsigned char *, size_t),
  148. void *p_rng,
  149. unsigned int nbits, int exponent );
  150. /**
  151. * \brief Check a public RSA key
  152. *
  153. * \param ctx RSA context to be checked
  154. *
  155. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  156. */
  157. int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx );
  158. /**
  159. * \brief Check a private RSA key
  160. *
  161. * \param ctx RSA context to be checked
  162. *
  163. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  164. */
  165. int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx );
  166. /**
  167. * \brief Check a public-private RSA key pair.
  168. * Check each of the contexts, and make sure they match.
  169. *
  170. * \param pub RSA context holding the public key
  171. * \param prv RSA context holding the private key
  172. *
  173. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  174. */
  175. int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, const mbedtls_rsa_context *prv );
  176. /**
  177. * \brief Do an RSA public key operation
  178. *
  179. * \param ctx RSA context
  180. * \param input input buffer
  181. * \param output output buffer
  182. *
  183. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  184. *
  185. * \note This function does NOT take care of message
  186. * padding. Also, be sure to set input[0] = 0 or assure that
  187. * input is smaller than N.
  188. *
  189. * \note The input and output buffers must be large
  190. * enough (eg. 128 bytes if RSA-1024 is used).
  191. */
  192. int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
  193. const unsigned char *input,
  194. unsigned char *output );
  195. /**
  196. * \brief Do an RSA private key operation
  197. *
  198. * \param ctx RSA context
  199. * \param f_rng RNG function (Needed for blinding)
  200. * \param p_rng RNG parameter
  201. * \param input input buffer
  202. * \param output output buffer
  203. *
  204. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  205. *
  206. * \note The input and output buffers must be large
  207. * enough (eg. 128 bytes if RSA-1024 is used).
  208. */
  209. int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
  210. int (*f_rng)(void *, unsigned char *, size_t),
  211. void *p_rng,
  212. const unsigned char *input,
  213. unsigned char *output );
  214. /**
  215. * \brief Generic wrapper to perform a PKCS#1 encryption using the
  216. * mode from the context. Add the message padding, then do an
  217. * RSA operation.
  218. *
  219. * \param ctx RSA context
  220. * \param f_rng RNG function (Needed for padding and PKCS#1 v2.1 encoding
  221. * and MBEDTLS_RSA_PRIVATE)
  222. * \param p_rng RNG parameter
  223. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  224. * \param ilen contains the plaintext length
  225. * \param input buffer holding the data to be encrypted
  226. * \param output buffer that will hold the ciphertext
  227. *
  228. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  229. *
  230. * \note The output buffer must be as large as the size
  231. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  232. */
  233. int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
  234. int (*f_rng)(void *, unsigned char *, size_t),
  235. void *p_rng,
  236. int mode, size_t ilen,
  237. const unsigned char *input,
  238. unsigned char *output );
  239. /**
  240. * \brief Perform a PKCS#1 v1.5 encryption (RSAES-PKCS1-v1_5-ENCRYPT)
  241. *
  242. * \param ctx RSA context
  243. * \param f_rng RNG function (Needed for padding and MBEDTLS_RSA_PRIVATE)
  244. * \param p_rng RNG parameter
  245. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  246. * \param ilen contains the plaintext length
  247. * \param input buffer holding the data to be encrypted
  248. * \param output buffer that will hold the ciphertext
  249. *
  250. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  251. *
  252. * \note The output buffer must be as large as the size
  253. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  254. */
  255. int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
  256. int (*f_rng)(void *, unsigned char *, size_t),
  257. void *p_rng,
  258. int mode, size_t ilen,
  259. const unsigned char *input,
  260. unsigned char *output );
  261. /**
  262. * \brief Perform a PKCS#1 v2.1 OAEP encryption (RSAES-OAEP-ENCRYPT)
  263. *
  264. * \param ctx RSA context
  265. * \param f_rng RNG function (Needed for padding and PKCS#1 v2.1 encoding
  266. * and MBEDTLS_RSA_PRIVATE)
  267. * \param p_rng RNG parameter
  268. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  269. * \param label buffer holding the custom label to use
  270. * \param label_len contains the label length
  271. * \param ilen contains the plaintext length
  272. * \param input buffer holding the data to be encrypted
  273. * \param output buffer that will hold the ciphertext
  274. *
  275. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  276. *
  277. * \note The output buffer must be as large as the size
  278. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  279. */
  280. int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
  281. int (*f_rng)(void *, unsigned char *, size_t),
  282. void *p_rng,
  283. int mode,
  284. const unsigned char *label, size_t label_len,
  285. size_t ilen,
  286. const unsigned char *input,
  287. unsigned char *output );
  288. /**
  289. * \brief Generic wrapper to perform a PKCS#1 decryption using the
  290. * mode from the context. Do an RSA operation, then remove
  291. * the message padding
  292. *
  293. * \param ctx RSA context
  294. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  295. * \param p_rng RNG parameter
  296. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  297. * \param olen will contain the plaintext length
  298. * \param input buffer holding the encrypted data
  299. * \param output buffer that will hold the plaintext
  300. * \param output_max_len maximum length of the output buffer
  301. *
  302. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  303. *
  304. * \note The output buffer must be as large as the size
  305. * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
  306. * an error is thrown.
  307. */
  308. int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
  309. int (*f_rng)(void *, unsigned char *, size_t),
  310. void *p_rng,
  311. int mode, size_t *olen,
  312. const unsigned char *input,
  313. unsigned char *output,
  314. size_t output_max_len );
  315. /**
  316. * \brief Perform a PKCS#1 v1.5 decryption (RSAES-PKCS1-v1_5-DECRYPT)
  317. *
  318. * \param ctx RSA context
  319. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  320. * \param p_rng RNG parameter
  321. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  322. * \param olen will contain the plaintext length
  323. * \param input buffer holding the encrypted data
  324. * \param output buffer that will hold the plaintext
  325. * \param output_max_len maximum length of the output buffer
  326. *
  327. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  328. *
  329. * \note The output buffer must be as large as the size
  330. * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
  331. * an error is thrown.
  332. */
  333. int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
  334. int (*f_rng)(void *, unsigned char *, size_t),
  335. void *p_rng,
  336. int mode, size_t *olen,
  337. const unsigned char *input,
  338. unsigned char *output,
  339. size_t output_max_len );
  340. /**
  341. * \brief Perform a PKCS#1 v2.1 OAEP decryption (RSAES-OAEP-DECRYPT)
  342. *
  343. * \param ctx RSA context
  344. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  345. * \param p_rng RNG parameter
  346. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  347. * \param label buffer holding the custom label to use
  348. * \param label_len contains the label length
  349. * \param olen will contain the plaintext length
  350. * \param input buffer holding the encrypted data
  351. * \param output buffer that will hold the plaintext
  352. * \param output_max_len maximum length of the output buffer
  353. *
  354. * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code
  355. *
  356. * \note The output buffer must be as large as the size
  357. * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
  358. * an error is thrown.
  359. */
  360. int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
  361. int (*f_rng)(void *, unsigned char *, size_t),
  362. void *p_rng,
  363. int mode,
  364. const unsigned char *label, size_t label_len,
  365. size_t *olen,
  366. const unsigned char *input,
  367. unsigned char *output,
  368. size_t output_max_len );
  369. /**
  370. * \brief Generic wrapper to perform a PKCS#1 signature using the
  371. * mode from the context. Do a private RSA operation to sign
  372. * a message digest
  373. *
  374. * \param ctx RSA context
  375. * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for
  376. * MBEDTLS_RSA_PRIVATE)
  377. * \param p_rng RNG parameter
  378. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  379. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  380. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  381. * \param hash buffer holding the message digest
  382. * \param sig buffer that will hold the ciphertext
  383. *
  384. * \return 0 if the signing operation was successful,
  385. * or an MBEDTLS_ERR_RSA_XXX error code
  386. *
  387. * \note The "sig" buffer must be as large as the size
  388. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  389. *
  390. * \note In case of PKCS#1 v2.1 encoding, see comments on
  391. * \note \c mbedtls_rsa_rsassa_pss_sign() for details on md_alg and hash_id.
  392. */
  393. int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
  394. int (*f_rng)(void *, unsigned char *, size_t),
  395. void *p_rng,
  396. int mode,
  397. mbedtls_md_type_t md_alg,
  398. unsigned int hashlen,
  399. const unsigned char *hash,
  400. unsigned char *sig );
  401. /**
  402. * \brief Perform a PKCS#1 v1.5 signature (RSASSA-PKCS1-v1_5-SIGN)
  403. *
  404. * \param ctx RSA context
  405. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  406. * \param p_rng RNG parameter
  407. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  408. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  409. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  410. * \param hash buffer holding the message digest
  411. * \param sig buffer that will hold the ciphertext
  412. *
  413. * \return 0 if the signing operation was successful,
  414. * or an MBEDTLS_ERR_RSA_XXX error code
  415. *
  416. * \note The "sig" buffer must be as large as the size
  417. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  418. */
  419. int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
  420. int (*f_rng)(void *, unsigned char *, size_t),
  421. void *p_rng,
  422. int mode,
  423. mbedtls_md_type_t md_alg,
  424. unsigned int hashlen,
  425. const unsigned char *hash,
  426. unsigned char *sig );
  427. /**
  428. * \brief Perform a PKCS#1 v2.1 PSS signature (RSASSA-PSS-SIGN)
  429. *
  430. * \param ctx RSA context
  431. * \param f_rng RNG function (Needed for PKCS#1 v2.1 encoding and for
  432. * MBEDTLS_RSA_PRIVATE)
  433. * \param p_rng RNG parameter
  434. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  435. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  436. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  437. * \param hash buffer holding the message digest
  438. * \param sig buffer that will hold the ciphertext
  439. *
  440. * \return 0 if the signing operation was successful,
  441. * or an MBEDTLS_ERR_RSA_XXX error code
  442. *
  443. * \note The "sig" buffer must be as large as the size
  444. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  445. *
  446. * \note The hash_id in the RSA context is the one used for the
  447. * encoding. md_alg in the function call is the type of hash
  448. * that is encoded. According to RFC 3447 it is advised to
  449. * keep both hashes the same.
  450. */
  451. int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
  452. int (*f_rng)(void *, unsigned char *, size_t),
  453. void *p_rng,
  454. int mode,
  455. mbedtls_md_type_t md_alg,
  456. unsigned int hashlen,
  457. const unsigned char *hash,
  458. unsigned char *sig );
  459. /**
  460. * \brief Generic wrapper to perform a PKCS#1 verification using the
  461. * mode from the context. Do a public RSA operation and check
  462. * the message digest
  463. *
  464. * \param ctx points to an RSA public key
  465. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  466. * \param p_rng RNG parameter
  467. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  468. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  469. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  470. * \param hash buffer holding the message digest
  471. * \param sig buffer holding the ciphertext
  472. *
  473. * \return 0 if the verify operation was successful,
  474. * or an MBEDTLS_ERR_RSA_XXX error code
  475. *
  476. * \note The "sig" buffer must be as large as the size
  477. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  478. *
  479. * \note In case of PKCS#1 v2.1 encoding, see comments on
  480. * \c mbedtls_rsa_rsassa_pss_verify() about md_alg and hash_id.
  481. */
  482. int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
  483. int (*f_rng)(void *, unsigned char *, size_t),
  484. void *p_rng,
  485. int mode,
  486. mbedtls_md_type_t md_alg,
  487. unsigned int hashlen,
  488. const unsigned char *hash,
  489. const unsigned char *sig );
  490. /**
  491. * \brief Perform a PKCS#1 v1.5 verification (RSASSA-PKCS1-v1_5-VERIFY)
  492. *
  493. * \param ctx points to an RSA public key
  494. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  495. * \param p_rng RNG parameter
  496. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  497. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  498. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  499. * \param hash buffer holding the message digest
  500. * \param sig buffer holding the ciphertext
  501. *
  502. * \return 0 if the verify operation was successful,
  503. * or an MBEDTLS_ERR_RSA_XXX error code
  504. *
  505. * \note The "sig" buffer must be as large as the size
  506. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  507. */
  508. int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
  509. int (*f_rng)(void *, unsigned char *, size_t),
  510. void *p_rng,
  511. int mode,
  512. mbedtls_md_type_t md_alg,
  513. unsigned int hashlen,
  514. const unsigned char *hash,
  515. const unsigned char *sig );
  516. /**
  517. * \brief Perform a PKCS#1 v2.1 PSS verification (RSASSA-PSS-VERIFY)
  518. * (This is the "simple" version.)
  519. *
  520. * \param ctx points to an RSA public key
  521. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  522. * \param p_rng RNG parameter
  523. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  524. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  525. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  526. * \param hash buffer holding the message digest
  527. * \param sig buffer holding the ciphertext
  528. *
  529. * \return 0 if the verify operation was successful,
  530. * or an MBEDTLS_ERR_RSA_XXX error code
  531. *
  532. * \note The "sig" buffer must be as large as the size
  533. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  534. *
  535. * \note The hash_id in the RSA context is the one used for the
  536. * verification. md_alg in the function call is the type of
  537. * hash that is verified. According to RFC 3447 it is advised to
  538. * keep both hashes the same. If hash_id in the RSA context is
  539. * unset, the md_alg from the function call is used.
  540. */
  541. int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
  542. int (*f_rng)(void *, unsigned char *, size_t),
  543. void *p_rng,
  544. int mode,
  545. mbedtls_md_type_t md_alg,
  546. unsigned int hashlen,
  547. const unsigned char *hash,
  548. const unsigned char *sig );
  549. /**
  550. * \brief Perform a PKCS#1 v2.1 PSS verification (RSASSA-PSS-VERIFY)
  551. * (This is the version with "full" options.)
  552. *
  553. * \param ctx points to an RSA public key
  554. * \param f_rng RNG function (Only needed for MBEDTLS_RSA_PRIVATE)
  555. * \param p_rng RNG parameter
  556. * \param mode MBEDTLS_RSA_PUBLIC or MBEDTLS_RSA_PRIVATE
  557. * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
  558. * \param hashlen message digest length (for MBEDTLS_MD_NONE only)
  559. * \param hash buffer holding the message digest
  560. * \param mgf1_hash_id message digest used for mask generation
  561. * \param expected_salt_len Length of the salt used in padding, use
  562. * MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length
  563. * \param sig buffer holding the ciphertext
  564. *
  565. * \return 0 if the verify operation was successful,
  566. * or an MBEDTLS_ERR_RSA_XXX error code
  567. *
  568. * \note The "sig" buffer must be as large as the size
  569. * of ctx->N (eg. 128 bytes if RSA-1024 is used).
  570. *
  571. * \note The hash_id in the RSA context is ignored.
  572. */
  573. int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
  574. int (*f_rng)(void *, unsigned char *, size_t),
  575. void *p_rng,
  576. int mode,
  577. mbedtls_md_type_t md_alg,
  578. unsigned int hashlen,
  579. const unsigned char *hash,
  580. mbedtls_md_type_t mgf1_hash_id,
  581. int expected_salt_len,
  582. const unsigned char *sig );
  583. /**
  584. * \brief Copy the components of an RSA context
  585. *
  586. * \param dst Destination context
  587. * \param src Source context
  588. *
  589. * \return 0 on success,
  590. * MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure
  591. */
  592. int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src );
  593. /**
  594. * \brief Free the components of an RSA key
  595. *
  596. * \param ctx RSA Context to free
  597. */
  598. void mbedtls_rsa_free( mbedtls_rsa_context *ctx );
  599. /**
  600. * \brief Checkup routine
  601. *
  602. * \return 0 if successful, or 1 if the test failed
  603. */
  604. int mbedtls_rsa_self_test( int verbose );
  605. #ifdef __cplusplus
  606. }
  607. #endif
  608. #endif /* MBEDTLS_RSA_C */
  609. #endif /* rsa.h */