Package-Level Type Names (total 5, in which 4 are exported)
/* sort exporteds by: | */
d*bigmod.Nat dP and dQ are used as exponents, so we store them as big-endian byte
slices to be passed to [bigmod.Nat.Exp]. // d mod (p - 1) // d mod (q - 1) fipsApproved is false if this key does not comply with FIPS 186-5 or
SP 800-56B Rev. 2. The following values are not set for deprecated multi-prime keys.
Since they are always set for keys in FIPS mode, for SP 800-56B Rev. 2
purposes we always use the Chinese Remainder Theorem (CRT) format. // p × q = n pub has already been checked with checkPublicKey. The following values are not set for deprecated multi-prime keys.
Since they are always set for keys in FIPS mode, for SP 800-56B Rev. 2
purposes we always use the Chinese Remainder Theorem (CRT) format. // p × q = n // qInv = q⁻¹ mod p Export returns the key parameters in big-endian byte slice format.
P, Q, dP, dQ, and qInv may be nil if the key was created with
NewPrivateKeyWithoutCRT.(*PrivateKey) PublicKey() *PublicKey
func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error)
func NewPrivateKey(N []byte, e int, d, P, Q []byte) (*PrivateKey, error)
func NewPrivateKeyWithoutCRT(N []byte, e int, d []byte) (*PrivateKey, error)
func NewPrivateKeyWithPrecomputation(N []byte, e int, d, P, Q, dP, dQ, qInv []byte) (*PrivateKey, error)
func newPrivateKey(n *bigmod.Modulus, e int, d *bigmod.Nat, p, q *bigmod.Modulus) (*PrivateKey, error)
func testPrivateKey() *PrivateKey
func crypto/rsa.fipsPrivateKey(priv *rsa.PrivateKey) (*PrivateKey, error)
func DecryptOAEP(hash, mgfHash hash.Hash, priv *PrivateKey, ciphertext []byte, label []byte) ([]byte, error)
func DecryptWithCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error)
func DecryptWithoutCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error)
func SignPKCS1v15(priv *PrivateKey, hash string, hashed []byte) ([]byte, error)
func SignPSS(rand io.Reader, priv *PrivateKey, hash hash.Hash, hashed []byte, saltLength int) ([]byte, error)
func checkPrivateKey(priv *PrivateKey) error
func decrypt(priv *PrivateKey, ciphertext []byte, check bool) ([]byte, error)
func signPKCS1v15(priv *PrivateKey, hash string, hashed []byte) ([]byte, error)
TestingOnlyLargeExponentPublicKey is a variant of [PublicKey] that supports
large public exponents. It is only meant for supporting the full ACVP test
suite, which unfortunately forces us to choose between a fixed exponent and
the full (2¹⁶, 2²⁵⁶) range. This type must not be used in production code,
nor for e values < 2³¹, which instead must use [PublicKey]. E is the public exponent, represented as a big-endian byte slice.N*bigmod.Modulus(*TestingOnlyLargeExponentPublicKey) Size() int
func TestingOnlyLargeExponentEncryptOAEP(hash, mgfHash hash.Hash, random io.Reader, pub *TestingOnlyLargeExponentPublicKey, msg []byte, label []byte) ([]byte, error)
func TestingOnlyLargeExponentVerifyPKCS1v15(pub *TestingOnlyLargeExponentPublicKey, hash string, hashed []byte, sig []byte) error
func TestingOnlyLargeExponentVerifyPSS(pub *TestingOnlyLargeExponentPublicKey, hash hash.Hash, digest []byte, sig []byte) error
func checkLargeExponentPublicKey(pub *TestingOnlyLargeExponentPublicKey) error
func encryptLargeExponent(pub *TestingOnlyLargeExponentPublicKey, plaintext []byte) ([]byte, error)
Package-Level Functions (total 46, in which 20 are exported)
DecryptOAEP decrypts ciphertext using RSAES-OAEP.
DecryptWithCheck performs the RSA private key operation and checks the
result to defend against errors in the CRT computation.
DecryptWithoutCheck performs the RSA private key operation.
Encrypt performs the RSA public key operation.
EncryptOAEP encrypts the given message with RSAES-OAEP.
GenerateKey generates a new RSA key pair of the given bit size.
bits must be at least 32.
It follows the process described at c2sp.org/det-keygen, which is compliant
with FIPS 186-5, Appendix A.1, IFC Key Pair Generation and FIPS 186-5,
Appendix A.1.3, Generation of Random Primes that are Probably Prime.
The prime candidates are drawn from rand, which in production will be the
global DRBG, while in tests can be an HMAC_DRBG as specified in
c2sp.org/det-keygen, to allow using its tests vectors.
NewPrivateKey creates a new RSA private key from the given parameters.
All values are in big-endian byte slice format, and may have leading zeros
or be shorter if leading zeroes were trimmed.
NewPrivateKeyWithoutCRT creates a new RSA private key from the given parameters.
This is meant for deprecated multi-prime keys, and is not FIPS 140 compliant.
NewPrivateKeyWithPrecomputation creates a new RSA private key from the given
parameters, which include precomputed CRT values.
PSSMaxSaltLength returns the maximum salt length for a given public key and
hash function.
SignPKCS1v15 calculates an RSASSA-PKCS1-v1.5 signature.
hash is the name of the hash function as returned by [crypto.Hash.String]
or the empty string to indicate that the message is signed directly.
SignPSS calculates the signature of hashed using RSASSA-PSS.
TestingOnlyLargeExponentDecryptOAEP decrypts ciphertext using RSAES-OAEP with
a private key that has a large public exponent. It is only meant for ACVP testing.
TestingOnlyLargeExponentEncryptOAEP encrypts the given message with RSAES-OAEP
using a public key with a large exponent. It is only meant for ACVP testing.
TestingOnlyNewLargeExponentPrivateKeyWithPrecomputation creates a new RSA private key
with a large public exponent from the given parameters. It is only meant for ACVP testing.
VerifyPKCS1v15 verifies an RSASSA-PKCS1-v1.5 signature.
hash is the name of the hash function as returned by [crypto.Hash.String]
or the empty string to indicate that the message is signed directly.
VerifyPSS verifies sig with RSASSA-PSS automatically detecting the salt length.
VerifyPSSWithSaltLength verifies sig with RSASSA-PSS and an expected salt length.
decrypt performs an RSA decryption of ciphertext into out. If check is true,
m^e is calculated and compared with ciphertext, in order to defend against
errors in the CRT computation.
incCounter increments a four byte, big-endian counter.
isPrime runs the Miller-Rabin Probabilistic Primality Test from
FIPS 186-5, Appendix B.3.1.
w must be a random integer equal to 3 mod 4 in big-endian order.
isPrime might return false positives for adversarially chosen values.
isPrime is not constant-time.
mgf1XOR XORs the bytes in out with a mask generated using the MGF1 function
specified in PKCS #1 v2.1.
millerRabinSetup prepares state that's reused across multiple iterations of
the Miller-Rabin test.
w must be a random integer equal to 3 mod 4 in big-endian order.
totient computes the Carmichael totient function λ(N) = lcm(p-1, q-1).
p and q must be primes congruent to 7 mod 8, so that p-1 and q-1 are both
even but not divisible by 4.
totient returns errDivisorTooLarge if GCD(p-1, q-1) is larger than 2³²-1.
These are ASN1 DER structures:
DigestInfo ::= SEQUENCE {
digestAlgorithm AlgorithmIdentifier,
digest OCTET STRING
}
For performance, we don't use the generic ASN1 encoder. Rather, we
precompute a prefix of the digest value that makes a valid ASN1 DER string
with the correct contents.
For any new entry, also add the size to [hashSize], and if applicable, add
the hash name to [checkApprovedHashName].
primes are the first prime numbers (except 2), such that the product of any
three primes fits in a uint32.
More primes cause fewer Miller-Rabin tests of composites (nothing can help
with the final test on the actual prime) but have diminishing returns: these
255 primes catch 84.9% of composites, the next 255 would catch 1.5% more.
Adding primes can still be marginally useful since they only compete with the
(much more expensive) first Miller-Rabin round for candidates that were not
rejected by the previous primes.
Package-Level Constants (total 5, none are exported)