Package-Level Type Names (total 3, in which 2 are exported)
/* sort exporteds by: | */
d*bigmod.Nat dP and dQ are used as exponents, so we store them as big-endian byte
slices to be passed to [bigmod.Nat.Exp]. // d mod (p - 1) // d mod (q - 1) fipsApproved is false if this key does not comply with FIPS 186-5 or
SP 800-56B Rev. 2. The following values are not set for deprecated multi-prime keys.
Since they are always set for keys in FIPS mode, for SP 800-56B Rev. 2
purposes we always use the Chinese Remainder Theorem (CRT) format. // p × q = n pub has already been checked with checkPublicKey. The following values are not set for deprecated multi-prime keys.
Since they are always set for keys in FIPS mode, for SP 800-56B Rev. 2
purposes we always use the Chinese Remainder Theorem (CRT) format. // p × q = n // qInv = q⁻¹ mod p Export returns the key parameters in big-endian byte slice format.
P, Q, dP, dQ, and qInv may be nil if the key was created with
NewPrivateKeyWithoutCRT.(*PrivateKey) PublicKey() *PublicKey
func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error)
func NewPrivateKey(N []byte, e int, d, P, Q []byte) (*PrivateKey, error)
func NewPrivateKeyWithoutCRT(N []byte, e int, d []byte) (*PrivateKey, error)
func NewPrivateKeyWithPrecomputation(N []byte, e int, d, P, Q, dP, dQ, qInv []byte) (*PrivateKey, error)
func newPrivateKey(n *bigmod.Modulus, e int, d *bigmod.Nat, p, q *bigmod.Modulus) (*PrivateKey, error)
func testPrivateKey() *PrivateKey
func crypto/rsa.fipsPrivateKey(priv *rsa.PrivateKey) (*PrivateKey, error)
func DecryptOAEP(hash, mgfHash fips140.Hash, priv *PrivateKey, ciphertext []byte, label []byte) ([]byte, error)
func DecryptWithCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error)
func DecryptWithoutCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error)
func SignPKCS1v15(priv *PrivateKey, hash string, hashed []byte) ([]byte, error)
func SignPSS(rand io.Reader, priv *PrivateKey, hash fips140.Hash, hashed []byte, saltLength int) ([]byte, error)
func checkPrivateKey(priv *PrivateKey) error
func decrypt(priv *PrivateKey, ciphertext []byte, check bool) ([]byte, error)
func signPKCS1v15(priv *PrivateKey, hash string, hashed []byte) ([]byte, error)
Package-Level Functions (total 36, in which 15 are exported)
DecryptOAEP decrypts ciphertext using RSAES-OAEP.
DecryptWithCheck performs the RSA private key operation and checks the
result to defend against errors in the CRT computation.
DecryptWithoutCheck performs the RSA private key operation.
Encrypt performs the RSA public key operation.
EncryptOAEP encrypts the given message with RSAES-OAEP.
GenerateKey generates a new RSA key pair of the given bit size.
bits must be at least 32.
NewPrivateKey creates a new RSA private key from the given parameters.
All values are in big-endian byte slice format, and may have leading zeros
or be shorter if leading zeroes were trimmed.
NewPrivateKeyWithoutCRT creates a new RSA private key from the given parameters.
This is meant for deprecated multi-prime keys, and is not FIPS 140 compliant.
NewPrivateKeyWithPrecomputation creates a new RSA private key from the given
parameters, which include precomputed CRT values.
PSSMaxSaltLength returns the maximum salt length for a given public key and
hash function.
SignPKCS1v15 calculates an RSASSA-PKCS1-v1.5 signature.
hash is the name of the hash function as returned by [crypto.Hash.String]
or the empty string to indicate that the message is signed directly.
SignPSS calculates the signature of hashed using RSASSA-PSS.
VerifyPKCS1v15 verifies an RSASSA-PKCS1-v1.5 signature.
hash is the name of the hash function as returned by [crypto.Hash.String]
or the empty string to indicate that the message is signed directly.
VerifyPSS verifies sig with RSASSA-PSS automatically detecting the salt length.
VerifyPSS verifies sig with RSASSA-PSS and an expected salt length.
decrypt performs an RSA decryption of ciphertext into out. If check is true,
m^e is calculated and compared with ciphertext, in order to defend against
errors in the CRT computation.
incCounter increments a four byte, big-endian counter.
isPrime runs the Miller-Rabin Probabilistic Primality Test from
FIPS 186-5, Appendix B.3.1.
w must be a random odd integer greater than three in big-endian order.
isPrime might return false positives for adversarially chosen values.
isPrime is not constant-time.
mgf1XOR XORs the bytes in out with a mask generated using the MGF1 function
specified in PKCS #1 v2.1.
These are ASN1 DER structures:
DigestInfo ::= SEQUENCE {
digestAlgorithm AlgorithmIdentifier,
digest OCTET STRING
}
For performance, we don't use the generic ASN1 encoder. Rather, we
precompute a prefix of the digest value that makes a valid ASN1 DER string
with the correct contents.
productOfPrimes is the product of the first 74 primes higher than 2.
The number of primes was selected to be the highest such that the product fit
in 512 bits, so to be usable for 1024 bit RSA keys.
Higher values cause fewer Miller-Rabin tests of composites (nothing can help
with the final test on the actual prime) but make InverseVarTime take longer.
Package-Level Constants (total 5, none are exported)