aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/pubkey/rsa
Commit message (Collapse)AuthorAgeFilesLines
* silence trivial warningsNuno Goncalves2019-10-201-2/+2
| | | | Signed-off-by: Nuno Goncalves <[email protected]>
* Add constant-time gcdJack Lloyd2019-10-121-1/+0
| | | | | Previous version leaked some (minimal) information from the loop bounds.
* Fix python testJack Lloyd2019-08-171-0/+2
|
* Have RSA key precompute Montgomery parametersJack Lloyd2019-08-172-163/+303
| | | | | | | | | If the application caches the PK_Signer or similar, then the performance is basically identical to what is done now. However for applications which create a new PK_Signer object per signature, then this improves performance by about 30%. Notably this includes the TLS layer.
* Avoid using old pow_mod interface in RSAJack Lloyd2019-08-171-7/+13
| | | | | On its own gives a modest speedup (3-5%) to RSA sign/decrypt, and it is needed for another more complicated optimization.
* Don't artificially limit very small RSA keys.Jack Lloyd2019-05-201-1/+6
| | | | | | | | | Keys smaller than 384 bits are trivially breakable, but that's true for 512 as well so no reason to draw the line there. Just do 5 bits since the smallest legal RSA key is 3*5 and that handles the integer overflow warning from Coverity which was the original reason for it. GH #1953
* Avoid a harmless data race in RSA decryptionJack Lloyd2019-01-281-0/+7
| | | | | | | | | Both threads called Modular_Reducer::reduce on m, which caused the significant words result to be written twice in an unsynchronized way. By calling it once beforehand it is computed and cached and so no additional writes occur. Found with helgrind.
* Fix Barrett reduction input boundJack Lloyd2018-12-261-8/+18
| | | | | | | | | | | | In the long ago when I wrote the Barrett code I must have missed that Barrett works for any input < 2^2k where k is the word size of the modulus. Fixing this has several nice effects, it is faster because it replaces a multiprecision comparison with a single size_t compare, and now the branch does not reveal information about the input or modulus, but only their word lengths, which is not considered sensitive. Fixing this allows reverting the change make in a57ce5a4fd2 and now RSA signing is even slightly faster than in 2.8, rather than 30% slower.
* Address a side channel in RSA and SM2Jack Lloyd2018-12-241-7/+3
| | | | | | | | | | | | | | | | | Barrett will branch to a different (and slower) algorithm if the input is larger than the square of the modulus. This branch can be detected by a side channel. For RSA we need to compute m % p and m % q to get CRT started. Being able to detect if m > q*q (assuming q is the smaller prime) allows a binary search on the secret prime. This attack is blocked by input blinding, but still seems dangerous. Unfortunately changing to use the generic const time modulo instead of Barrett introduces a rather severe performance regression in RSA signing. In SM2, reduce k-r*x modulo the order before multiplying it with (x-1)^-1. Otherwise the need for slow modulo vs Barrett leaks information about k and/or x.
* Avoid doing a variable time division during Montgomery setupJack Lloyd2018-12-091-9/+14
| | | | | | Instead require the inputs be reduced already. For RSA-CRT use Barrett which is const time already. For SRP6 inputs were not reduced, use the Barrett hook available in DL_Group.
* Use ct_modulo during RSA key generationJack Lloyd2018-12-031-6/+7
|
* Avoid an implausible integer overflow flagged by Coverity [ci skip]Jack Lloyd2018-11-101-1/+6
|
* Add some missing includesJack Lloyd2018-11-081-0/+2
| | | | This is not exhaustive. See GH #1733
* Add functions to get size of PK ciphertext,plaintextJack Lloyd2018-08-101-0/+4
| | | | Needed for https://github.com/strongswan/strongswan/pull/109
* Add PK_Signer::signature_lengthJack Lloyd2018-08-101-0/+2
|
* Some fiddling with RSA private operationJack Lloyd2018-06-221-18/+29
| | | | | Spawning the thread off as quickly as possible helps perf slighty, especially with larger modulus.
* Avoid leaking size of exponentJack Lloyd2018-06-171-10/+17
| | | | See #1606 for discussion
* DER improvementsJack Lloyd2018-05-221-4/+6
| | | | | | | | | | | Let DER_Encoder write to a user specified vector instead of only to an internal vector. This allows encoding to a std::vector without having to first write to a locked vector and then copying out the result. Add ASN1_Object::BER_encode convenience method. Replaces X509_Object::BER_encode which had the same logic but was restricted to a subtype. This replaces many cases where DER_Encoder was just used to encode a single object (X509_DN, AlgorithmIdentifier, etc).
* Add a comment on side channels hereJack Lloyd2018-04-261-4/+5
|
* Avoid potential side channel when generating RSA primesJack Lloyd2018-04-171-2/+6
| | | | | | | | | | Add a new function dedicated to generating RSA primes. Don't test for p.bits() > bits until the very end - rarely happens, and speeds up prime generation quite noticably. Add Miller-Rabin error probabilities for 1/2**128, which again speeds up RSA keygen and DL param gen quite a bit.
* Add const time annotationsJack Lloyd2018-04-151-1/+1
|
* Add a Montgomery exponentiation that takes variable timeJack Lloyd2018-04-091-7/+14
| | | | | | | | In the case of RSA encryption/verification the public exponent is... public. So we don't need to carefully guard against side channels that leak the exponent. Improves RSA verification performance by 50% or more.
* Work around a bug in MSVC lambda handlingJack Lloyd2018-04-041-1/+1
|
* Add RSA exponent blindingJack Lloyd2018-04-041-5/+12
| | | | Additional paranoia never hurt.
* Tweak how RSA private operations are performedJack Lloyd2018-04-041-25/+44
| | | | Improves perf by about 15%
* Throw Lookup_Error here for benefit of testsJack Lloyd2018-03-211-2/+2
|
* Remove PK_Ops::Decryption_with_EME::max_raw_input_bitsJack Lloyd2018-02-191-2/+0
| | | | | Unused and not exposed to higher levels. RSA and ElGamal both check their inputs vs the system parameters (n, p) after decoding.
* Use new DL_Group functionsJack Lloyd2018-02-191-1/+1
|
* Tighten up RSA key validity testsJack Lloyd2018-02-131-3/+7
| | | | They allowed even e, another leftover from Rabin-Williams
* Remove handling of even e in RSA keygenJack Lloyd2018-02-131-5/+2
| | | | | This is a holdover from Rabin-Williams support and just confusing in RSA-specific code.
* Apply final annotations to the library alsoJack Lloyd2017-09-222-7/+7
| | | | | Done by a perl script which converted all classes to final, followed by selective reversion where it caused compilation failures.
* More include header cleanupsJack Lloyd2017-09-212-2/+2
|
* Change header guard format to BOTAN_FOO_H_Jack Lloyd2017-09-201-2/+2
| | | | | | ISO C++ reserves names with double underscores in them Closes #512
* Add API stability annotations.Jack Lloyd2017-09-191-2/+2
| | | | | Defined in build.h, all equal to BOTAN_DLL so ties into existing system for exporting symbols.
* Content:Tomasz Frydrych2017-04-032-5/+5
| | | | | | | | | * fixes for deprecated constructions in c++11 and later (explicit rule of 3/5 or implicit rule of 0 and other violations) * `default` specifier instead of `{}` in some places(probably all) * removal of unreachable code (for example `return` after `throw`) * removal of compilation unit only visible, but not used functions * fix for `throw()` specifier - used instead `BOTAN_NOEXCEPT` * removed not needed semicolons
* Remove "Dirty hack" for multiple defines in lex_me_harder()Simon Warta2017-04-021-1/+3
|
* Remove verify_end() chained immediatly before end_cons() (close #890)Nuno Goncalves2017-02-251-1/+0
| | | | | | | BER_Decoder::end_cons() allready assures the verify_end() function, so it is redundant. Signed-off-by: Nuno Goncalves <[email protected]>
* increase miller-rabin iterations for RSA strong check_key. We call is_prime ↵Never2017-02-131-1/+1
| | | | with prob=128 during sampling and we should check with the same prob
* Fix private key ctors API docs [ci skip]René Korthaus2017-01-271-1/+1
|
* Convert to using standard uintN_t integer typesJack Lloyd2016-12-182-16/+16
| | | | | | Renames a couple of functions for somewhat better name consistency, eg make_u32bit becomes make_uint32. The old typedefs remain for now since probably lots of application code uses them.
* Public_Key derived class ctors take an std::vector<byte>René Korthaus2016-12-112-3/+3
| | | | | | | Changes all the Public_Key derived classes ctors to take a std::vector instead of a secure_vector for the DER encoded public key bits. There is no point in transporting a public key in secure storage. (GH #768)
* Add Private_Key::private_key_info()René Korthaus2016-12-052-2/+2
| | | | | | | Adds new Private_Key::private_key_info() that returns a PKCS#8 PrivateKeyInfo structure. Renames the current Private_Key::pkcs8_private_key() to private_key_bits(). BER_encode() just invokes private_key_info().
* Add Public_Key::subject_public_key()René Korthaus2016-12-052-2/+2
| | | | | | | Adds new Public_Key::subject_public_key() that returns a X.509 SubjectPublicKey structure. Renames the current Public_Key::x509_subject_public_key() to public_key_bits(). BER_encode() just invokes subject_public_key().
* Pubkey cleanupsJack Lloyd2016-11-122-3/+7
| | | | | | | | | | Add Public_Key::key_length usable for policy checking (as in TLS::Policy::check_peer_key_acceptable) Remove Public_Key::max_input_bits because it didn't make much sense for most algorithms actually. Remove message_parts and message_part_size from PK_Ops
* Remove Key_Type typedefsJack Lloyd2016-11-081-6/+0
| | | | Also part of Algo_Registry and not needed after #668
* Update Doxygen comment [ci skip]Jack Lloyd2016-11-061-1/+0
|
* Remove automatic self-testing of public and private keysJack Lloyd2016-11-032-15/+4
| | | | | | | | | | | | | Rarely expected and often causes performance problems, especially for private keys. Instead applications should call check_key explicitly to validate keys when necessary. Note this removal doesn't apply to tests like ECDH on-the-curve tests, where a check on the public key is required for security of our own key. Updates most APIs to remove RNG calls, where they are no longer required. Exception is PKCS8 interface, pending further work there (see GH #685) it just ignores the RNG argument now.
* Fix doxygen warnings [ci skip]René Korthaus2016-10-191-1/+1
|
* Improve pubkey doxygen [ci skip]René Korthaus2016-10-191-1/+12
|
* Indent include so amalgamation works correctlyJack Lloyd2016-10-171-2/+1
| | | | | Otherwise <future> is thrown into the top of botan_all.h which causes problems on IncludeOS
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-22 03:07:51 +0000