1 /* crypto/rsa/rsa_eay.c */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 #include "cryptlib.h" 61 #include <openssl/bn.h> 62 #include <openssl/rsa.h> 63 #include <openssl/rand.h> 64 #include <openssl/engine.h> 65 66 #ifndef RSA_NULL 67 68 static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 69 unsigned char *to, RSA *rsa,int padding); 70 static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 71 unsigned char *to, RSA *rsa,int padding); 72 static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 73 unsigned char *to, RSA *rsa,int padding); 74 static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 75 unsigned char *to, RSA *rsa,int padding); 76 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa); 77 static int RSA_eay_init(RSA *rsa); 78 static int RSA_eay_finish(RSA *rsa); 79 static RSA_METHOD rsa_pkcs1_eay_meth={ 80 "Eric Young's PKCS#1 RSA", 81 RSA_eay_public_encrypt, 82 RSA_eay_public_decrypt, /* signature verification */ 83 RSA_eay_private_encrypt, /* signing */ 84 RSA_eay_private_decrypt, 85 RSA_eay_mod_exp, 86 BN_mod_exp_mont, /* XXX probably we should not use Montgomery if e == 3 */ 87 RSA_eay_init, 88 RSA_eay_finish, 89 0, /* flags */ 90 NULL, 91 0, /* rsa_sign */ 92 0 /* rsa_verify */ 93 }; 94 95 const RSA_METHOD *RSA_PKCS1_SSLeay(void) 96 { 97 return(&rsa_pkcs1_eay_meth); 98 } 99 100 static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 101 unsigned char *to, RSA *rsa, int padding) 102 { 103 BIGNUM f,ret; 104 int i,j,k,num=0,r= -1; 105 unsigned char *buf=NULL; 106 BN_CTX *ctx=NULL; 107 108 BN_init(&f); 109 BN_init(&ret); 110 if ((ctx=BN_CTX_new()) == NULL) goto err; 111 num=BN_num_bytes(rsa->n); 112 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 113 { 114 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE); 115 goto err; 116 } 117 118 switch (padding) 119 { 120 case RSA_PKCS1_PADDING: 121 i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen); 122 break; 123 #ifndef OPENSSL_NO_SHA 124 case RSA_PKCS1_OAEP_PADDING: 125 i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0); 126 break; 127 #endif 128 case RSA_SSLV23_PADDING: 129 i=RSA_padding_add_SSLv23(buf,num,from,flen); 130 break; 131 case RSA_NO_PADDING: 132 i=RSA_padding_add_none(buf,num,from,flen); 133 break; 134 default: 135 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 136 goto err; 137 } 138 if (i <= 0) goto err; 139 140 if (BN_bin2bn(buf,num,&f) == NULL) goto err; 141 142 if (BN_ucmp(&f, rsa->n) >= 0) 143 { 144 /* usually the padding functions would catch this */ 145 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 146 goto err; 147 } 148 149 if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC)) 150 { 151 BN_MONT_CTX* bn_mont_ctx; 152 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 153 goto err; 154 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx)) 155 { 156 BN_MONT_CTX_free(bn_mont_ctx); 157 goto err; 158 } 159 if (rsa->_method_mod_n == NULL) /* other thread may have finished first */ 160 { 161 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 162 if (rsa->_method_mod_n == NULL) 163 { 164 rsa->_method_mod_n = bn_mont_ctx; 165 bn_mont_ctx = NULL; 166 } 167 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 168 } 169 if (bn_mont_ctx) 170 BN_MONT_CTX_free(bn_mont_ctx); 171 } 172 173 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, 174 rsa->_method_mod_n)) goto err; 175 176 /* put in leading 0 bytes if the number is less than the 177 * length of the modulus */ 178 j=BN_num_bytes(&ret); 179 i=BN_bn2bin(&ret,&(to[num-j])); 180 for (k=0; k<(num-i); k++) 181 to[k]=0; 182 183 r=num; 184 err: 185 if (ctx != NULL) BN_CTX_free(ctx); 186 BN_clear_free(&f); 187 BN_clear_free(&ret); 188 if (buf != NULL) 189 { 190 memset(buf,0,num); 191 OPENSSL_free(buf); 192 } 193 return(r); 194 } 195 196 static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx) 197 { 198 int ret = 1; 199 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 200 /* Check again inside the lock - the macro's check is racey */ 201 if(rsa->blinding == NULL) 202 ret = RSA_blinding_on(rsa, ctx); 203 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 204 return ret; 205 } 206 207 #define BLINDING_HELPER(rsa, ctx, err_instr) \ 208 do { \ 209 if(((rsa)->flags & RSA_FLAG_BLINDING) && \ 210 ((rsa)->blinding == NULL) && \ 211 !rsa_eay_blinding(rsa, ctx)) \ 212 err_instr \ 213 } while(0) 214 215 /* signing */ 216 static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 217 unsigned char *to, RSA *rsa, int padding) 218 { 219 BIGNUM f,ret; 220 int i,j,k,num=0,r= -1; 221 unsigned char *buf=NULL; 222 BN_CTX *ctx=NULL; 223 224 BN_init(&f); 225 BN_init(&ret); 226 227 if ((ctx=BN_CTX_new()) == NULL) goto err; 228 num=BN_num_bytes(rsa->n); 229 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 230 { 231 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE); 232 goto err; 233 } 234 235 switch (padding) 236 { 237 case RSA_PKCS1_PADDING: 238 i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen); 239 break; 240 case RSA_NO_PADDING: 241 i=RSA_padding_add_none(buf,num,from,flen); 242 break; 243 case RSA_SSLV23_PADDING: 244 default: 245 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 246 goto err; 247 } 248 if (i <= 0) goto err; 249 250 if (BN_bin2bn(buf,num,&f) == NULL) goto err; 251 252 if (BN_ucmp(&f, rsa->n) >= 0) 253 { 254 /* usually the padding functions would catch this */ 255 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 256 goto err; 257 } 258 259 BLINDING_HELPER(rsa, ctx, goto err;); 260 261 if (rsa->flags & RSA_FLAG_BLINDING) 262 if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; 263 264 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 265 ((rsa->p != NULL) && 266 (rsa->q != NULL) && 267 (rsa->dmp1 != NULL) && 268 (rsa->dmq1 != NULL) && 269 (rsa->iqmp != NULL)) ) 270 { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } 271 else 272 { 273 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err; 274 } 275 276 if (rsa->flags & RSA_FLAG_BLINDING) 277 if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; 278 279 /* put in leading 0 bytes if the number is less than the 280 * length of the modulus */ 281 j=BN_num_bytes(&ret); 282 i=BN_bn2bin(&ret,&(to[num-j])); 283 for (k=0; k<(num-i); k++) 284 to[k]=0; 285 286 r=num; 287 err: 288 if (ctx != NULL) BN_CTX_free(ctx); 289 BN_clear_free(&ret); 290 BN_clear_free(&f); 291 if (buf != NULL) 292 { 293 memset(buf,0,num); 294 OPENSSL_free(buf); 295 } 296 return(r); 297 } 298 299 static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 300 unsigned char *to, RSA *rsa, int padding) 301 { 302 BIGNUM f,ret; 303 int j,num=0,r= -1; 304 unsigned char *p; 305 unsigned char *buf=NULL; 306 BN_CTX *ctx=NULL; 307 308 BN_init(&f); 309 BN_init(&ret); 310 ctx=BN_CTX_new(); 311 if (ctx == NULL) goto err; 312 313 num=BN_num_bytes(rsa->n); 314 315 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 316 { 317 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE); 318 goto err; 319 } 320 321 /* This check was for equality but PGP does evil things 322 * and chops off the top '0' bytes */ 323 if (flen > num) 324 { 325 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 326 goto err; 327 } 328 329 /* make data into a big number */ 330 if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err; 331 332 if (BN_ucmp(&f, rsa->n) >= 0) 333 { 334 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 335 goto err; 336 } 337 338 BLINDING_HELPER(rsa, ctx, goto err;); 339 340 if (rsa->flags & RSA_FLAG_BLINDING) 341 if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; 342 343 /* do the decrypt */ 344 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 345 ((rsa->p != NULL) && 346 (rsa->q != NULL) && 347 (rsa->dmp1 != NULL) && 348 (rsa->dmq1 != NULL) && 349 (rsa->iqmp != NULL)) ) 350 { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } 351 else 352 { 353 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) 354 goto err; 355 } 356 357 if (rsa->flags & RSA_FLAG_BLINDING) 358 if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; 359 360 p=buf; 361 j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */ 362 363 switch (padding) 364 { 365 case RSA_PKCS1_PADDING: 366 r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num); 367 break; 368 #ifndef OPENSSL_NO_SHA 369 case RSA_PKCS1_OAEP_PADDING: 370 r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0); 371 break; 372 #endif 373 case RSA_SSLV23_PADDING: 374 r=RSA_padding_check_SSLv23(to,num,buf,j,num); 375 break; 376 case RSA_NO_PADDING: 377 r=RSA_padding_check_none(to,num,buf,j,num); 378 break; 379 default: 380 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 381 goto err; 382 } 383 if (r < 0) 384 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 385 386 err: 387 if (ctx != NULL) BN_CTX_free(ctx); 388 BN_clear_free(&f); 389 BN_clear_free(&ret); 390 if (buf != NULL) 391 { 392 memset(buf,0,num); 393 OPENSSL_free(buf); 394 } 395 return(r); 396 } 397 398 /* signature verification */ 399 static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 400 unsigned char *to, RSA *rsa, int padding) 401 { 402 BIGNUM f,ret; 403 int i,num=0,r= -1; 404 unsigned char *p; 405 unsigned char *buf=NULL; 406 BN_CTX *ctx=NULL; 407 408 BN_init(&f); 409 BN_init(&ret); 410 ctx=BN_CTX_new(); 411 if (ctx == NULL) goto err; 412 413 num=BN_num_bytes(rsa->n); 414 buf=(unsigned char *)OPENSSL_malloc(num); 415 if (buf == NULL) 416 { 417 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE); 418 goto err; 419 } 420 421 /* This check was for equality but PGP does evil things 422 * and chops off the top '0' bytes */ 423 if (flen > num) 424 { 425 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 426 goto err; 427 } 428 429 if (BN_bin2bn(from,flen,&f) == NULL) goto err; 430 431 if (BN_ucmp(&f, rsa->n) >= 0) 432 { 433 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 434 goto err; 435 } 436 437 /* do the decrypt */ 438 if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC)) 439 { 440 BN_MONT_CTX* bn_mont_ctx; 441 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 442 goto err; 443 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx)) 444 { 445 BN_MONT_CTX_free(bn_mont_ctx); 446 goto err; 447 } 448 if (rsa->_method_mod_n == NULL) /* other thread may have finished first */ 449 { 450 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 451 if (rsa->_method_mod_n == NULL) 452 { 453 rsa->_method_mod_n = bn_mont_ctx; 454 bn_mont_ctx = NULL; 455 } 456 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 457 } 458 if (bn_mont_ctx) 459 BN_MONT_CTX_free(bn_mont_ctx); 460 } 461 462 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, 463 rsa->_method_mod_n)) goto err; 464 465 p=buf; 466 i=BN_bn2bin(&ret,p); 467 468 switch (padding) 469 { 470 case RSA_PKCS1_PADDING: 471 r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num); 472 break; 473 case RSA_NO_PADDING: 474 r=RSA_padding_check_none(to,num,buf,i,num); 475 break; 476 default: 477 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 478 goto err; 479 } 480 if (r < 0) 481 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 482 483 err: 484 if (ctx != NULL) BN_CTX_free(ctx); 485 BN_clear_free(&f); 486 BN_clear_free(&ret); 487 if (buf != NULL) 488 { 489 memset(buf,0,num); 490 OPENSSL_free(buf); 491 } 492 return(r); 493 } 494 495 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) 496 { 497 BIGNUM r1,m1,vrfy; 498 int ret=0; 499 BN_CTX *ctx; 500 501 BN_init(&m1); 502 BN_init(&r1); 503 BN_init(&vrfy); 504 if ((ctx=BN_CTX_new()) == NULL) goto err; 505 506 if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) 507 { 508 if (rsa->_method_mod_p == NULL) 509 { 510 BN_MONT_CTX* bn_mont_ctx; 511 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 512 goto err; 513 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx)) 514 { 515 BN_MONT_CTX_free(bn_mont_ctx); 516 goto err; 517 } 518 if (rsa->_method_mod_p == NULL) /* other thread may have finished first */ 519 { 520 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 521 if (rsa->_method_mod_p == NULL) 522 { 523 rsa->_method_mod_p = bn_mont_ctx; 524 bn_mont_ctx = NULL; 525 } 526 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 527 } 528 if (bn_mont_ctx) 529 BN_MONT_CTX_free(bn_mont_ctx); 530 } 531 532 if (rsa->_method_mod_q == NULL) 533 { 534 BN_MONT_CTX* bn_mont_ctx; 535 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 536 goto err; 537 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx)) 538 { 539 BN_MONT_CTX_free(bn_mont_ctx); 540 goto err; 541 } 542 if (rsa->_method_mod_q == NULL) /* other thread may have finished first */ 543 { 544 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 545 if (rsa->_method_mod_q == NULL) 546 { 547 rsa->_method_mod_q = bn_mont_ctx; 548 bn_mont_ctx = NULL; 549 } 550 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 551 } 552 if (bn_mont_ctx) 553 BN_MONT_CTX_free(bn_mont_ctx); 554 } 555 } 556 557 if (!BN_mod(&r1,I,rsa->q,ctx)) goto err; 558 if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx, 559 rsa->_method_mod_q)) goto err; 560 561 if (!BN_mod(&r1,I,rsa->p,ctx)) goto err; 562 if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx, 563 rsa->_method_mod_p)) goto err; 564 565 if (!BN_sub(r0,r0,&m1)) goto err; 566 /* This will help stop the size of r0 increasing, which does 567 * affect the multiply if it optimised for a power of 2 size */ 568 if (r0->neg) 569 if (!BN_add(r0,r0,rsa->p)) goto err; 570 571 if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err; 572 if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err; 573 /* If p < q it is occasionally possible for the correction of 574 * adding 'p' if r0 is negative above to leave the result still 575 * negative. This can break the private key operations: the following 576 * second correction should *always* correct this rare occurrence. 577 * This will *never* happen with OpenSSL generated keys because 578 * they ensure p > q [steve] 579 */ 580 if (r0->neg) 581 if (!BN_add(r0,r0,rsa->p)) goto err; 582 if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err; 583 if (!BN_add(r0,&r1,&m1)) goto err; 584 585 if (rsa->e && rsa->n) 586 { 587 if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err; 588 /* If 'I' was greater than (or equal to) rsa->n, the operation 589 * will be equivalent to using 'I mod n'. However, the result of 590 * the verify will *always* be less than 'n' so we don't check 591 * for absolute equality, just congruency. */ 592 if (!BN_sub(&vrfy, &vrfy, I)) goto err; 593 if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err; 594 if (vrfy.neg) 595 if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err; 596 if (!BN_is_zero(&vrfy)) 597 /* 'I' and 'vrfy' aren't congruent mod n. Don't leak 598 * miscalculated CRT output, just do a raw (slower) 599 * mod_exp and return that instead. */ 600 if (!rsa->meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err; 601 } 602 ret=1; 603 err: 604 BN_clear_free(&m1); 605 BN_clear_free(&r1); 606 BN_clear_free(&vrfy); 607 BN_CTX_free(ctx); 608 return(ret); 609 } 610 611 static int RSA_eay_init(RSA *rsa) 612 { 613 rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE; 614 return(1); 615 } 616 617 static int RSA_eay_finish(RSA *rsa) 618 { 619 if (rsa->_method_mod_n != NULL) 620 BN_MONT_CTX_free(rsa->_method_mod_n); 621 if (rsa->_method_mod_p != NULL) 622 BN_MONT_CTX_free(rsa->_method_mod_p); 623 if (rsa->_method_mod_q != NULL) 624 BN_MONT_CTX_free(rsa->_method_mod_q); 625 return(1); 626 } 627 628 #endif 629