rsa-keyprop.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728
  1. // SPDX-License-Identifier: GPL-2.0+ and MIT
  2. /*
  3. * RSA library - generate parameters for a public key
  4. *
  5. * Copyright (c) 2019 Linaro Limited
  6. * Author: AKASHI Takahiro
  7. *
  8. * Big number routines in this file come from BearSSL:
  9. * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
  10. */
  11. #include <common.h>
  12. #include <image.h>
  13. #include <malloc.h>
  14. #include <asm/byteorder.h>
  15. #include <crypto/internal/rsa.h>
  16. #include <u-boot/rsa-mod-exp.h>
  17. /**
  18. * br_dec16be() - Convert 16-bit big-endian integer to native
  19. * @src: Pointer to data
  20. * Return: Native-endian integer
  21. */
  22. static unsigned br_dec16be(const void *src)
  23. {
  24. return be16_to_cpup(src);
  25. }
  26. /**
  27. * br_dec32be() - Convert 32-bit big-endian integer to native
  28. * @src: Pointer to data
  29. * Return: Native-endian integer
  30. */
  31. static uint32_t br_dec32be(const void *src)
  32. {
  33. return be32_to_cpup(src);
  34. }
  35. /**
  36. * br_enc32be() - Convert native 32-bit integer to big-endian
  37. * @dst: Pointer to buffer to store big-endian integer in
  38. * @x: Native 32-bit integer
  39. */
  40. static void br_enc32be(void *dst, uint32_t x)
  41. {
  42. __be32 tmp;
  43. tmp = cpu_to_be32(x);
  44. memcpy(dst, &tmp, sizeof(tmp));
  45. }
  46. /* from BearSSL's src/inner.h */
  47. /*
  48. * Negate a boolean.
  49. */
  50. static uint32_t NOT(uint32_t ctl)
  51. {
  52. return ctl ^ 1;
  53. }
  54. /*
  55. * Multiplexer: returns x if ctl == 1, y if ctl == 0.
  56. */
  57. static uint32_t MUX(uint32_t ctl, uint32_t x, uint32_t y)
  58. {
  59. return y ^ (-ctl & (x ^ y));
  60. }
  61. /*
  62. * Equality check: returns 1 if x == y, 0 otherwise.
  63. */
  64. static uint32_t EQ(uint32_t x, uint32_t y)
  65. {
  66. uint32_t q;
  67. q = x ^ y;
  68. return NOT((q | -q) >> 31);
  69. }
  70. /*
  71. * Inequality check: returns 1 if x != y, 0 otherwise.
  72. */
  73. static uint32_t NEQ(uint32_t x, uint32_t y)
  74. {
  75. uint32_t q;
  76. q = x ^ y;
  77. return (q | -q) >> 31;
  78. }
  79. /*
  80. * Comparison: returns 1 if x > y, 0 otherwise.
  81. */
  82. static uint32_t GT(uint32_t x, uint32_t y)
  83. {
  84. /*
  85. * If both x < 2^31 and y < 2^31, then y-x will have its high
  86. * bit set if x > y, cleared otherwise.
  87. *
  88. * If either x >= 2^31 or y >= 2^31 (but not both), then the
  89. * result is the high bit of x.
  90. *
  91. * If both x >= 2^31 and y >= 2^31, then we can virtually
  92. * subtract 2^31 from both, and we are back to the first case.
  93. * Since (y-2^31)-(x-2^31) = y-x, the subtraction is already
  94. * fine.
  95. */
  96. uint32_t z;
  97. z = y - x;
  98. return (z ^ ((x ^ y) & (x ^ z))) >> 31;
  99. }
  100. /*
  101. * Compute the bit length of a 32-bit integer. Returned value is between 0
  102. * and 32 (inclusive).
  103. */
  104. static uint32_t BIT_LENGTH(uint32_t x)
  105. {
  106. uint32_t k, c;
  107. k = NEQ(x, 0);
  108. c = GT(x, 0xFFFF); x = MUX(c, x >> 16, x); k += c << 4;
  109. c = GT(x, 0x00FF); x = MUX(c, x >> 8, x); k += c << 3;
  110. c = GT(x, 0x000F); x = MUX(c, x >> 4, x); k += c << 2;
  111. c = GT(x, 0x0003); x = MUX(c, x >> 2, x); k += c << 1;
  112. k += GT(x, 0x0001);
  113. return k;
  114. }
  115. #define GE(x, y) NOT(GT(y, x))
  116. #define LT(x, y) GT(y, x)
  117. #define MUL(x, y) ((uint64_t)(x) * (uint64_t)(y))
  118. /*
  119. * Integers 'i32'
  120. * --------------
  121. *
  122. * The 'i32' functions implement computations on big integers using
  123. * an internal representation as an array of 32-bit integers. For
  124. * an array x[]:
  125. * -- x[0] contains the "announced bit length" of the integer
  126. * -- x[1], x[2]... contain the value in little-endian order (x[1]
  127. * contains the least significant 32 bits)
  128. *
  129. * Multiplications rely on the elementary 32x32->64 multiplication.
  130. *
  131. * The announced bit length specifies the number of bits that are
  132. * significant in the subsequent 32-bit words. Unused bits in the
  133. * last (most significant) word are set to 0; subsequent words are
  134. * uninitialized and need not exist at all.
  135. *
  136. * The execution time and memory access patterns of all computations
  137. * depend on the announced bit length, but not on the actual word
  138. * values. For modular integers, the announced bit length of any integer
  139. * modulo n is equal to the actual bit length of n; thus, computations
  140. * on modular integers are "constant-time" (only the modulus length may
  141. * leak).
  142. */
  143. /*
  144. * Extract one word from an integer. The offset is counted in bits.
  145. * The word MUST entirely fit within the word elements corresponding
  146. * to the announced bit length of a[].
  147. */
  148. static uint32_t br_i32_word(const uint32_t *a, uint32_t off)
  149. {
  150. size_t u;
  151. unsigned j;
  152. u = (size_t)(off >> 5) + 1;
  153. j = (unsigned)off & 31;
  154. if (j == 0) {
  155. return a[u];
  156. } else {
  157. return (a[u] >> j) | (a[u + 1] << (32 - j));
  158. }
  159. }
  160. /* from BearSSL's src/int/i32_bitlen.c */
  161. /*
  162. * Compute the actual bit length of an integer. The argument x should
  163. * point to the first (least significant) value word of the integer.
  164. * The len 'xlen' contains the number of 32-bit words to access.
  165. *
  166. * CT: value or length of x does not leak.
  167. */
  168. static uint32_t br_i32_bit_length(uint32_t *x, size_t xlen)
  169. {
  170. uint32_t tw, twk;
  171. tw = 0;
  172. twk = 0;
  173. while (xlen -- > 0) {
  174. uint32_t w, c;
  175. c = EQ(tw, 0);
  176. w = x[xlen];
  177. tw = MUX(c, w, tw);
  178. twk = MUX(c, (uint32_t)xlen, twk);
  179. }
  180. return (twk << 5) + BIT_LENGTH(tw);
  181. }
  182. /* from BearSSL's src/int/i32_decode.c */
  183. /*
  184. * Decode an integer from its big-endian unsigned representation. The
  185. * "true" bit length of the integer is computed, but all words of x[]
  186. * corresponding to the full 'len' bytes of the source are set.
  187. *
  188. * CT: value or length of x does not leak.
  189. */
  190. static void br_i32_decode(uint32_t *x, const void *src, size_t len)
  191. {
  192. const unsigned char *buf;
  193. size_t u, v;
  194. buf = src;
  195. u = len;
  196. v = 1;
  197. for (;;) {
  198. if (u < 4) {
  199. uint32_t w;
  200. if (u < 2) {
  201. if (u == 0) {
  202. break;
  203. } else {
  204. w = buf[0];
  205. }
  206. } else {
  207. if (u == 2) {
  208. w = br_dec16be(buf);
  209. } else {
  210. w = ((uint32_t)buf[0] << 16)
  211. | br_dec16be(buf + 1);
  212. }
  213. }
  214. x[v ++] = w;
  215. break;
  216. } else {
  217. u -= 4;
  218. x[v ++] = br_dec32be(buf + u);
  219. }
  220. }
  221. x[0] = br_i32_bit_length(x + 1, v - 1);
  222. }
  223. /* from BearSSL's src/int/i32_encode.c */
  224. /*
  225. * Encode an integer into its big-endian unsigned representation. The
  226. * output length in bytes is provided (parameter 'len'); if the length
  227. * is too short then the integer is appropriately truncated; if it is
  228. * too long then the extra bytes are set to 0.
  229. */
  230. static void br_i32_encode(void *dst, size_t len, const uint32_t *x)
  231. {
  232. unsigned char *buf;
  233. size_t k;
  234. buf = dst;
  235. /*
  236. * Compute the announced size of x in bytes; extra bytes are
  237. * filled with zeros.
  238. */
  239. k = (x[0] + 7) >> 3;
  240. while (len > k) {
  241. *buf ++ = 0;
  242. len --;
  243. }
  244. /*
  245. * Now we use k as index within x[]. That index starts at 1;
  246. * we initialize it to the topmost complete word, and process
  247. * any remaining incomplete word.
  248. */
  249. k = (len + 3) >> 2;
  250. switch (len & 3) {
  251. case 3:
  252. *buf ++ = x[k] >> 16;
  253. /* fall through */
  254. case 2:
  255. *buf ++ = x[k] >> 8;
  256. /* fall through */
  257. case 1:
  258. *buf ++ = x[k];
  259. k --;
  260. }
  261. /*
  262. * Encode all complete words.
  263. */
  264. while (k > 0) {
  265. br_enc32be(buf, x[k]);
  266. k --;
  267. buf += 4;
  268. }
  269. }
  270. /* from BearSSL's src/int/i32_ninv32.c */
  271. /*
  272. * Compute -(1/x) mod 2^32. If x is even, then this function returns 0.
  273. */
  274. static uint32_t br_i32_ninv32(uint32_t x)
  275. {
  276. uint32_t y;
  277. y = 2 - x;
  278. y *= 2 - y * x;
  279. y *= 2 - y * x;
  280. y *= 2 - y * x;
  281. y *= 2 - y * x;
  282. return MUX(x & 1, -y, 0);
  283. }
  284. /* from BearSSL's src/int/i32_add.c */
  285. /*
  286. * Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[]
  287. * is unmodified, but the carry is still computed and returned. The
  288. * arrays a[] and b[] MUST have the same announced bit length.
  289. *
  290. * a[] and b[] MAY be the same array, but partial overlap is not allowed.
  291. */
  292. static uint32_t br_i32_add(uint32_t *a, const uint32_t *b, uint32_t ctl)
  293. {
  294. uint32_t cc;
  295. size_t u, m;
  296. cc = 0;
  297. m = (a[0] + 63) >> 5;
  298. for (u = 1; u < m; u ++) {
  299. uint32_t aw, bw, naw;
  300. aw = a[u];
  301. bw = b[u];
  302. naw = aw + bw + cc;
  303. /*
  304. * Carry is 1 if naw < aw. Carry is also 1 if naw == aw
  305. * AND the carry was already 1.
  306. */
  307. cc = (cc & EQ(naw, aw)) | LT(naw, aw);
  308. a[u] = MUX(ctl, naw, aw);
  309. }
  310. return cc;
  311. }
  312. /* from BearSSL's src/int/i32_sub.c */
  313. /*
  314. * Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0,
  315. * then a[] is unmodified, but the carry is still computed and returned.
  316. * The arrays a[] and b[] MUST have the same announced bit length.
  317. *
  318. * a[] and b[] MAY be the same array, but partial overlap is not allowed.
  319. */
  320. static uint32_t br_i32_sub(uint32_t *a, const uint32_t *b, uint32_t ctl)
  321. {
  322. uint32_t cc;
  323. size_t u, m;
  324. cc = 0;
  325. m = (a[0] + 63) >> 5;
  326. for (u = 1; u < m; u ++) {
  327. uint32_t aw, bw, naw;
  328. aw = a[u];
  329. bw = b[u];
  330. naw = aw - bw - cc;
  331. /*
  332. * Carry is 1 if naw > aw. Carry is 1 also if naw == aw
  333. * AND the carry was already 1.
  334. */
  335. cc = (cc & EQ(naw, aw)) | GT(naw, aw);
  336. a[u] = MUX(ctl, naw, aw);
  337. }
  338. return cc;
  339. }
  340. /* from BearSSL's src/int/i32_div32.c */
  341. /*
  342. * Constant-time division. The dividend hi:lo is divided by the
  343. * divisor d; the quotient is returned and the remainder is written
  344. * in *r. If hi == d, then the quotient does not fit on 32 bits;
  345. * returned value is thus truncated. If hi > d, returned values are
  346. * indeterminate.
  347. */
  348. static uint32_t br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r)
  349. {
  350. /* TODO: optimize this */
  351. uint32_t q;
  352. uint32_t ch, cf;
  353. int k;
  354. q = 0;
  355. ch = EQ(hi, d);
  356. hi = MUX(ch, 0, hi);
  357. for (k = 31; k > 0; k --) {
  358. int j;
  359. uint32_t w, ctl, hi2, lo2;
  360. j = 32 - k;
  361. w = (hi << j) | (lo >> k);
  362. ctl = GE(w, d) | (hi >> k);
  363. hi2 = (w - d) >> j;
  364. lo2 = lo - (d << k);
  365. hi = MUX(ctl, hi2, hi);
  366. lo = MUX(ctl, lo2, lo);
  367. q |= ctl << k;
  368. }
  369. cf = GE(lo, d) | hi;
  370. q |= cf;
  371. *r = MUX(cf, lo - d, lo);
  372. return q;
  373. }
  374. /*
  375. * Wrapper for br_divrem(); the remainder is returned, and the quotient
  376. * is discarded.
  377. */
  378. static uint32_t br_rem(uint32_t hi, uint32_t lo, uint32_t d)
  379. {
  380. uint32_t r;
  381. br_divrem(hi, lo, d, &r);
  382. return r;
  383. }
  384. /*
  385. * Wrapper for br_divrem(); the quotient is returned, and the remainder
  386. * is discarded.
  387. */
  388. static uint32_t br_div(uint32_t hi, uint32_t lo, uint32_t d)
  389. {
  390. uint32_t r;
  391. return br_divrem(hi, lo, d, &r);
  392. }
  393. /* from BearSSL's src/int/i32_muladd.c */
  394. /*
  395. * Multiply x[] by 2^32 and then add integer z, modulo m[]. This
  396. * function assumes that x[] and m[] have the same announced bit
  397. * length, and the announced bit length of m[] matches its true
  398. * bit length.
  399. *
  400. * x[] and m[] MUST be distinct arrays.
  401. *
  402. * CT: only the common announced bit length of x and m leaks, not
  403. * the values of x, z or m.
  404. */
  405. static void br_i32_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m)
  406. {
  407. uint32_t m_bitlen;
  408. size_t u, mlen;
  409. uint32_t a0, a1, b0, hi, g, q, tb;
  410. uint32_t chf, clow, under, over;
  411. uint64_t cc;
  412. /*
  413. * We can test on the modulus bit length since we accept to
  414. * leak that length.
  415. */
  416. m_bitlen = m[0];
  417. if (m_bitlen == 0) {
  418. return;
  419. }
  420. if (m_bitlen <= 32) {
  421. x[1] = br_rem(x[1], z, m[1]);
  422. return;
  423. }
  424. mlen = (m_bitlen + 31) >> 5;
  425. /*
  426. * Principle: we estimate the quotient (x*2^32+z)/m by
  427. * doing a 64/32 division with the high words.
  428. *
  429. * Let:
  430. * w = 2^32
  431. * a = (w*a0 + a1) * w^N + a2
  432. * b = b0 * w^N + b2
  433. * such that:
  434. * 0 <= a0 < w
  435. * 0 <= a1 < w
  436. * 0 <= a2 < w^N
  437. * w/2 <= b0 < w
  438. * 0 <= b2 < w^N
  439. * a < w*b
  440. * I.e. the two top words of a are a0:a1, the top word of b is
  441. * b0, we ensured that b0 is "full" (high bit set), and a is
  442. * such that the quotient q = a/b fits on one word (0 <= q < w).
  443. *
  444. * If a = b*q + r (with 0 <= r < q), we can estimate q by
  445. * doing an Euclidean division on the top words:
  446. * a0*w+a1 = b0*u + v (with 0 <= v < w)
  447. * Then the following holds:
  448. * 0 <= u <= w
  449. * u-2 <= q <= u
  450. */
  451. a0 = br_i32_word(x, m_bitlen - 32);
  452. hi = x[mlen];
  453. memmove(x + 2, x + 1, (mlen - 1) * sizeof *x);
  454. x[1] = z;
  455. a1 = br_i32_word(x, m_bitlen - 32);
  456. b0 = br_i32_word(m, m_bitlen - 32);
  457. /*
  458. * We estimate a divisor q. If the quotient returned by br_div()
  459. * is g:
  460. * -- If a0 == b0 then g == 0; we want q = 0xFFFFFFFF.
  461. * -- Otherwise:
  462. * -- if g == 0 then we set q = 0;
  463. * -- otherwise, we set q = g - 1.
  464. * The properties described above then ensure that the true
  465. * quotient is q-1, q or q+1.
  466. */
  467. g = br_div(a0, a1, b0);
  468. q = MUX(EQ(a0, b0), 0xFFFFFFFF, MUX(EQ(g, 0), 0, g - 1));
  469. /*
  470. * We subtract q*m from x (with the extra high word of value 'hi').
  471. * Since q may be off by 1 (in either direction), we may have to
  472. * add or subtract m afterwards.
  473. *
  474. * The 'tb' flag will be true (1) at the end of the loop if the
  475. * result is greater than or equal to the modulus (not counting
  476. * 'hi' or the carry).
  477. */
  478. cc = 0;
  479. tb = 1;
  480. for (u = 1; u <= mlen; u ++) {
  481. uint32_t mw, zw, xw, nxw;
  482. uint64_t zl;
  483. mw = m[u];
  484. zl = MUL(mw, q) + cc;
  485. cc = (uint32_t)(zl >> 32);
  486. zw = (uint32_t)zl;
  487. xw = x[u];
  488. nxw = xw - zw;
  489. cc += (uint64_t)GT(nxw, xw);
  490. x[u] = nxw;
  491. tb = MUX(EQ(nxw, mw), tb, GT(nxw, mw));
  492. }
  493. /*
  494. * If we underestimated q, then either cc < hi (one extra bit
  495. * beyond the top array word), or cc == hi and tb is true (no
  496. * extra bit, but the result is not lower than the modulus). In
  497. * these cases we must subtract m once.
  498. *
  499. * Otherwise, we may have overestimated, which will show as
  500. * cc > hi (thus a negative result). Correction is adding m once.
  501. */
  502. chf = (uint32_t)(cc >> 32);
  503. clow = (uint32_t)cc;
  504. over = chf | GT(clow, hi);
  505. under = ~over & (tb | (~chf & LT(clow, hi)));
  506. br_i32_add(x, m, over);
  507. br_i32_sub(x, m, under);
  508. }
  509. /* from BearSSL's src/int/i32_reduce.c */
  510. /*
  511. * Reduce an integer (a[]) modulo another (m[]). The result is written
  512. * in x[] and its announced bit length is set to be equal to that of m[].
  513. *
  514. * x[] MUST be distinct from a[] and m[].
  515. *
  516. * CT: only announced bit lengths leak, not values of x, a or m.
  517. */
  518. static void br_i32_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m)
  519. {
  520. uint32_t m_bitlen, a_bitlen;
  521. size_t mlen, alen, u;
  522. m_bitlen = m[0];
  523. mlen = (m_bitlen + 31) >> 5;
  524. x[0] = m_bitlen;
  525. if (m_bitlen == 0) {
  526. return;
  527. }
  528. /*
  529. * If the source is shorter, then simply copy all words from a[]
  530. * and zero out the upper words.
  531. */
  532. a_bitlen = a[0];
  533. alen = (a_bitlen + 31) >> 5;
  534. if (a_bitlen < m_bitlen) {
  535. memcpy(x + 1, a + 1, alen * sizeof *a);
  536. for (u = alen; u < mlen; u ++) {
  537. x[u + 1] = 0;
  538. }
  539. return;
  540. }
  541. /*
  542. * The source length is at least equal to that of the modulus.
  543. * We must thus copy N-1 words, and input the remaining words
  544. * one by one.
  545. */
  546. memcpy(x + 1, a + 2 + (alen - mlen), (mlen - 1) * sizeof *a);
  547. x[mlen] = 0;
  548. for (u = 1 + alen - mlen; u > 0; u --) {
  549. br_i32_muladd_small(x, a[u], m);
  550. }
  551. }
  552. /**
  553. * rsa_free_key_prop() - Free key properties
  554. * @prop: Pointer to struct key_prop
  555. *
  556. * This function frees all the memories allocated by rsa_gen_key_prop().
  557. */
  558. void rsa_free_key_prop(struct key_prop *prop)
  559. {
  560. if (!prop)
  561. return;
  562. free((void *)prop->modulus);
  563. free((void *)prop->public_exponent);
  564. free((void *)prop->rr);
  565. free(prop);
  566. }
  567. /**
  568. * rsa_gen_key_prop() - Generate key properties of RSA public key
  569. * @key: Specifies key data in DER format
  570. * @keylen: Length of @key
  571. * @prop: Generated key property
  572. *
  573. * This function takes a blob of encoded RSA public key data in DER
  574. * format, parse it and generate all the relevant properties
  575. * in key_prop structure.
  576. * Return a pointer to struct key_prop in @prop on success.
  577. *
  578. * Return: 0 on success, negative on error
  579. */
  580. int rsa_gen_key_prop(const void *key, uint32_t keylen, struct key_prop **prop)
  581. {
  582. struct rsa_key rsa_key;
  583. uint32_t *n = NULL, *rr = NULL, *rrtmp = NULL;
  584. int rlen, i, ret = 0;
  585. *prop = calloc(sizeof(**prop), 1);
  586. if (!(*prop)) {
  587. ret = -ENOMEM;
  588. goto out;
  589. }
  590. ret = rsa_parse_pub_key(&rsa_key, key, keylen);
  591. if (ret)
  592. goto out;
  593. /* modulus */
  594. /* removing leading 0's */
  595. for (i = 0; i < rsa_key.n_sz && !rsa_key.n[i]; i++)
  596. ;
  597. (*prop)->num_bits = (rsa_key.n_sz - i) * 8;
  598. (*prop)->modulus = malloc(rsa_key.n_sz - i);
  599. if (!(*prop)->modulus) {
  600. ret = -ENOMEM;
  601. goto out;
  602. }
  603. memcpy((void *)(*prop)->modulus, &rsa_key.n[i], rsa_key.n_sz - i);
  604. n = calloc(sizeof(uint32_t), 1 + ((*prop)->num_bits >> 5));
  605. rr = calloc(sizeof(uint32_t), 1 + (((*prop)->num_bits * 2) >> 5));
  606. rrtmp = calloc(sizeof(uint32_t), 2 + (((*prop)->num_bits * 2) >> 5));
  607. if (!n || !rr || !rrtmp) {
  608. ret = -ENOMEM;
  609. goto out;
  610. }
  611. /* exponent */
  612. (*prop)->public_exponent = calloc(1, sizeof(uint64_t));
  613. if (!(*prop)->public_exponent) {
  614. ret = -ENOMEM;
  615. goto out;
  616. }
  617. memcpy((void *)(*prop)->public_exponent + sizeof(uint64_t)
  618. - rsa_key.e_sz,
  619. rsa_key.e, rsa_key.e_sz);
  620. (*prop)->exp_len = sizeof(uint64_t);
  621. /* n0 inverse */
  622. br_i32_decode(n, &rsa_key.n[i], rsa_key.n_sz - i);
  623. (*prop)->n0inv = br_i32_ninv32(n[1]);
  624. /* R^2 mod n; R = 2^(num_bits) */
  625. rlen = (*prop)->num_bits * 2; /* #bits of R^2 = (2^num_bits)^2 */
  626. rr[0] = 0;
  627. *(uint8_t *)&rr[0] = (1 << (rlen % 8));
  628. for (i = 1; i < (((rlen + 31) >> 5) + 1); i++)
  629. rr[i] = 0;
  630. br_i32_decode(rrtmp, rr, ((rlen + 7) >> 3) + 1);
  631. br_i32_reduce(rr, rrtmp, n);
  632. rlen = ((*prop)->num_bits + 7) >> 3; /* #bytes of R^2 mod n */
  633. (*prop)->rr = malloc(rlen);
  634. if (!(*prop)->rr) {
  635. ret = -ENOMEM;
  636. goto out;
  637. }
  638. br_i32_encode((void *)(*prop)->rr, rlen, rr);
  639. out:
  640. free(n);
  641. free(rr);
  642. free(rrtmp);
  643. if (ret < 0)
  644. rsa_free_key_prop(*prop);
  645. return ret;
  646. }