xref: /openbsd-src/lib/libcrypto/rsa/rsa_eay.c (revision c58501deba7359712e47f5af5c9ade2b346f1ca5)
1 /* crypto/rsa/rsa_eay.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 
59 #include <stdio.h>
60 #include "cryptlib.h"
61 #include <openssl/bn.h>
62 #include <openssl/rsa.h>
63 #include <openssl/rand.h>
64 #include <openssl/engine.h>
65 
66 #ifndef RSA_NULL
67 
68 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
69 		unsigned char *to, RSA *rsa,int padding);
70 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
71 		unsigned char *to, RSA *rsa,int padding);
72 static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
73 		unsigned char *to, RSA *rsa,int padding);
74 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
75 		unsigned char *to, RSA *rsa,int padding);
76 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa);
77 static int RSA_eay_init(RSA *rsa);
78 static int RSA_eay_finish(RSA *rsa);
79 static RSA_METHOD rsa_pkcs1_eay_meth={
80 	"Eric Young's PKCS#1 RSA",
81 	RSA_eay_public_encrypt,
82 	RSA_eay_public_decrypt, /* signature verification */
83 	RSA_eay_private_encrypt, /* signing */
84 	RSA_eay_private_decrypt,
85 	RSA_eay_mod_exp,
86 	BN_mod_exp_mont, /* XXX probably we should not use Montgomery if  e == 3 */
87 	RSA_eay_init,
88 	RSA_eay_finish,
89 	0, /* flags */
90 	NULL,
91 	0, /* rsa_sign */
92 	0  /* rsa_verify */
93 	};
94 
95 const RSA_METHOD *RSA_PKCS1_SSLeay(void)
96 	{
97 	return(&rsa_pkcs1_eay_meth);
98 	}
99 
100 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
101 	     unsigned char *to, RSA *rsa, int padding)
102 	{
103 	BIGNUM f,ret;
104 	int i,j,k,num=0,r= -1;
105 	unsigned char *buf=NULL;
106 	BN_CTX *ctx=NULL;
107 
108 	BN_init(&f);
109 	BN_init(&ret);
110 	if ((ctx=BN_CTX_new()) == NULL) goto err;
111 	num=BN_num_bytes(rsa->n);
112 	if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
113 		{
114 		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);
115 		goto err;
116 		}
117 
118 	switch (padding)
119 		{
120 	case RSA_PKCS1_PADDING:
121 		i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen);
122 		break;
123 #ifndef OPENSSL_NO_SHA
124 	case RSA_PKCS1_OAEP_PADDING:
125 	        i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0);
126 		break;
127 #endif
128 	case RSA_SSLV23_PADDING:
129 		i=RSA_padding_add_SSLv23(buf,num,from,flen);
130 		break;
131 	case RSA_NO_PADDING:
132 		i=RSA_padding_add_none(buf,num,from,flen);
133 		break;
134 	default:
135 		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
136 		goto err;
137 		}
138 	if (i <= 0) goto err;
139 
140 	if (BN_bin2bn(buf,num,&f) == NULL) goto err;
141 
142 	if (BN_ucmp(&f, rsa->n) >= 0)
143 		{
144 		/* usually the padding functions would catch this */
145 		RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
146 		goto err;
147 		}
148 
149 	if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
150 		{
151 		BN_MONT_CTX* bn_mont_ctx;
152 		if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
153 			goto err;
154 		if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
155 			{
156 			BN_MONT_CTX_free(bn_mont_ctx);
157 			goto err;
158 			}
159 		if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
160 			{
161 			CRYPTO_w_lock(CRYPTO_LOCK_RSA);
162 			if (rsa->_method_mod_n == NULL)
163 				{
164 				rsa->_method_mod_n = bn_mont_ctx;
165 				bn_mont_ctx = NULL;
166 				}
167 			CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
168 			}
169 		if (bn_mont_ctx)
170 			BN_MONT_CTX_free(bn_mont_ctx);
171 		}
172 
173 	if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
174 		rsa->_method_mod_n)) goto err;
175 
176 	/* put in leading 0 bytes if the number is less than the
177 	 * length of the modulus */
178 	j=BN_num_bytes(&ret);
179 	i=BN_bn2bin(&ret,&(to[num-j]));
180 	for (k=0; k<(num-i); k++)
181 		to[k]=0;
182 
183 	r=num;
184 err:
185 	if (ctx != NULL) BN_CTX_free(ctx);
186 	BN_clear_free(&f);
187 	BN_clear_free(&ret);
188 	if (buf != NULL)
189 		{
190 		memset(buf,0,num);
191 		OPENSSL_free(buf);
192 		}
193 	return(r);
194 	}
195 
196 /* signing */
197 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
198 	     unsigned char *to, RSA *rsa, int padding)
199 	{
200 	BIGNUM f,ret;
201 	int i,j,k,num=0,r= -1;
202 	unsigned char *buf=NULL;
203 	BN_CTX *ctx=NULL;
204 
205 	BN_init(&f);
206 	BN_init(&ret);
207 
208 	if ((ctx=BN_CTX_new()) == NULL) goto err;
209 	num=BN_num_bytes(rsa->n);
210 	if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
211 		{
212 		RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
213 		goto err;
214 		}
215 
216 	switch (padding)
217 		{
218 	case RSA_PKCS1_PADDING:
219 		i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen);
220 		break;
221 	case RSA_NO_PADDING:
222 		i=RSA_padding_add_none(buf,num,from,flen);
223 		break;
224 	case RSA_SSLV23_PADDING:
225 	default:
226 		RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
227 		goto err;
228 		}
229 	if (i <= 0) goto err;
230 
231 	if (BN_bin2bn(buf,num,&f) == NULL) goto err;
232 
233 	if (BN_ucmp(&f, rsa->n) >= 0)
234 		{
235 		/* usually the padding functions would catch this */
236 		RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
237 		goto err;
238 		}
239 
240 	if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL))
241 		RSA_blinding_on(rsa,ctx);
242 	if (rsa->flags & RSA_FLAG_BLINDING)
243 		if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
244 
245 	if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
246 		((rsa->p != NULL) &&
247 		(rsa->q != NULL) &&
248 		(rsa->dmp1 != NULL) &&
249 		(rsa->dmq1 != NULL) &&
250 		(rsa->iqmp != NULL)) )
251 		{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
252 	else
253 		{
254 		if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err;
255 		}
256 
257 	if (rsa->flags & RSA_FLAG_BLINDING)
258 		if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err;
259 
260 	/* put in leading 0 bytes if the number is less than the
261 	 * length of the modulus */
262 	j=BN_num_bytes(&ret);
263 	i=BN_bn2bin(&ret,&(to[num-j]));
264 	for (k=0; k<(num-i); k++)
265 		to[k]=0;
266 
267 	r=num;
268 err:
269 	if (ctx != NULL) BN_CTX_free(ctx);
270 	BN_clear_free(&ret);
271 	BN_clear_free(&f);
272 	if (buf != NULL)
273 		{
274 		memset(buf,0,num);
275 		OPENSSL_free(buf);
276 		}
277 	return(r);
278 	}
279 
280 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
281 	     unsigned char *to, RSA *rsa, int padding)
282 	{
283 	BIGNUM f,ret;
284 	int j,num=0,r= -1;
285 	unsigned char *p;
286 	unsigned char *buf=NULL;
287 	BN_CTX *ctx=NULL;
288 
289 	BN_init(&f);
290 	BN_init(&ret);
291 	ctx=BN_CTX_new();
292 	if (ctx == NULL) goto err;
293 
294 	num=BN_num_bytes(rsa->n);
295 
296 	if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
297 		{
298 		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
299 		goto err;
300 		}
301 
302 	/* This check was for equality but PGP does evil things
303 	 * and chops off the top '0' bytes */
304 	if (flen > num)
305 		{
306 		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
307 		goto err;
308 		}
309 
310 	/* make data into a big number */
311 	if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err;
312 
313 	if (BN_ucmp(&f, rsa->n) >= 0)
314 		{
315 		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
316 		goto err;
317 		}
318 
319 	if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL))
320 		RSA_blinding_on(rsa,ctx);
321 	if (rsa->flags & RSA_FLAG_BLINDING)
322 		if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
323 
324 	/* do the decrypt */
325 	if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
326 		((rsa->p != NULL) &&
327 		(rsa->q != NULL) &&
328 		(rsa->dmp1 != NULL) &&
329 		(rsa->dmq1 != NULL) &&
330 		(rsa->iqmp != NULL)) )
331 		{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; }
332 	else
333 		{
334 		if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL))
335 			goto err;
336 		}
337 
338 	if (rsa->flags & RSA_FLAG_BLINDING)
339 		if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err;
340 
341 	p=buf;
342 	j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */
343 
344 	switch (padding)
345 		{
346 	case RSA_PKCS1_PADDING:
347 		r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num);
348 		break;
349 #ifndef OPENSSL_NO_SHA
350         case RSA_PKCS1_OAEP_PADDING:
351 	        r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0);
352                 break;
353 #endif
354  	case RSA_SSLV23_PADDING:
355 		r=RSA_padding_check_SSLv23(to,num,buf,j,num);
356 		break;
357 	case RSA_NO_PADDING:
358 		r=RSA_padding_check_none(to,num,buf,j,num);
359 		break;
360 	default:
361 		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
362 		goto err;
363 		}
364 	if (r < 0)
365 		RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
366 
367 err:
368 	if (ctx != NULL) BN_CTX_free(ctx);
369 	BN_clear_free(&f);
370 	BN_clear_free(&ret);
371 	if (buf != NULL)
372 		{
373 		memset(buf,0,num);
374 		OPENSSL_free(buf);
375 		}
376 	return(r);
377 	}
378 
379 /* signature verification */
380 static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
381 	     unsigned char *to, RSA *rsa, int padding)
382 	{
383 	BIGNUM f,ret;
384 	int i,num=0,r= -1;
385 	unsigned char *p;
386 	unsigned char *buf=NULL;
387 	BN_CTX *ctx=NULL;
388 
389 	BN_init(&f);
390 	BN_init(&ret);
391 	ctx=BN_CTX_new();
392 	if (ctx == NULL) goto err;
393 
394 	num=BN_num_bytes(rsa->n);
395 	buf=(unsigned char *)OPENSSL_malloc(num);
396 	if (buf == NULL)
397 		{
398 		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);
399 		goto err;
400 		}
401 
402 	/* This check was for equality but PGP does evil things
403 	 * and chops off the top '0' bytes */
404 	if (flen > num)
405 		{
406 		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);
407 		goto err;
408 		}
409 
410 	if (BN_bin2bn(from,flen,&f) == NULL) goto err;
411 
412 	if (BN_ucmp(&f, rsa->n) >= 0)
413 		{
414 		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
415 		goto err;
416 		}
417 
418 	/* do the decrypt */
419 	if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC))
420 		{
421 		BN_MONT_CTX* bn_mont_ctx;
422 		if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
423 			goto err;
424 		if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx))
425 			{
426 			BN_MONT_CTX_free(bn_mont_ctx);
427 			goto err;
428 			}
429 		if (rsa->_method_mod_n == NULL) /* other thread may have finished first */
430 			{
431 			CRYPTO_w_lock(CRYPTO_LOCK_RSA);
432 			if (rsa->_method_mod_n == NULL)
433 				{
434 				rsa->_method_mod_n = bn_mont_ctx;
435 				bn_mont_ctx = NULL;
436 				}
437 			CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
438 			}
439 		if (bn_mont_ctx)
440 			BN_MONT_CTX_free(bn_mont_ctx);
441 		}
442 
443 	if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
444 		rsa->_method_mod_n)) goto err;
445 
446 	p=buf;
447 	i=BN_bn2bin(&ret,p);
448 
449 	switch (padding)
450 		{
451 	case RSA_PKCS1_PADDING:
452 		r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);
453 		break;
454 	case RSA_NO_PADDING:
455 		r=RSA_padding_check_none(to,num,buf,i,num);
456 		break;
457 	default:
458 		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);
459 		goto err;
460 		}
461 	if (r < 0)
462 		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
463 
464 err:
465 	if (ctx != NULL) BN_CTX_free(ctx);
466 	BN_clear_free(&f);
467 	BN_clear_free(&ret);
468 	if (buf != NULL)
469 		{
470 		memset(buf,0,num);
471 		OPENSSL_free(buf);
472 		}
473 	return(r);
474 	}
475 
476 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
477 	{
478 	BIGNUM r1,m1,vrfy;
479 	int ret=0;
480 	BN_CTX *ctx;
481 
482 	BN_init(&m1);
483 	BN_init(&r1);
484 	BN_init(&vrfy);
485 	if ((ctx=BN_CTX_new()) == NULL) goto err;
486 
487 	if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
488 		{
489 		if (rsa->_method_mod_p == NULL)
490 			{
491 			BN_MONT_CTX* bn_mont_ctx;
492 			if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
493 				goto err;
494 			if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx))
495 				{
496 				BN_MONT_CTX_free(bn_mont_ctx);
497 				goto err;
498 				}
499 			if (rsa->_method_mod_p == NULL) /* other thread may have finished first */
500 				{
501 				CRYPTO_w_lock(CRYPTO_LOCK_RSA);
502 				if (rsa->_method_mod_p == NULL)
503 					{
504 					rsa->_method_mod_p = bn_mont_ctx;
505 					bn_mont_ctx = NULL;
506 					}
507 				CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
508 				}
509 			if (bn_mont_ctx)
510 				BN_MONT_CTX_free(bn_mont_ctx);
511 			}
512 
513 		if (rsa->_method_mod_q == NULL)
514 			{
515 			BN_MONT_CTX* bn_mont_ctx;
516 			if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL)
517 				goto err;
518 			if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx))
519 				{
520 				BN_MONT_CTX_free(bn_mont_ctx);
521 				goto err;
522 				}
523 			if (rsa->_method_mod_q == NULL) /* other thread may have finished first */
524 				{
525 				CRYPTO_w_lock(CRYPTO_LOCK_RSA);
526 				if (rsa->_method_mod_q == NULL)
527 					{
528 					rsa->_method_mod_q = bn_mont_ctx;
529 					bn_mont_ctx = NULL;
530 					}
531 				CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
532 				}
533 			if (bn_mont_ctx)
534 				BN_MONT_CTX_free(bn_mont_ctx);
535 			}
536 		}
537 
538 	if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
539 	if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
540 		rsa->_method_mod_q)) goto err;
541 
542 	if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
543 	if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,
544 		rsa->_method_mod_p)) goto err;
545 
546 	if (!BN_sub(r0,r0,&m1)) goto err;
547 	/* This will help stop the size of r0 increasing, which does
548 	 * affect the multiply if it optimised for a power of 2 size */
549 	if (r0->neg)
550 		if (!BN_add(r0,r0,rsa->p)) goto err;
551 
552 	if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;
553 	if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;
554 	/* If p < q it is occasionally possible for the correction of
555          * adding 'p' if r0 is negative above to leave the result still
556 	 * negative. This can break the private key operations: the following
557 	 * second correction should *always* correct this rare occurrence.
558 	 * This will *never* happen with OpenSSL generated keys because
559          * they ensure p > q [steve]
560          */
561 	if (r0->neg)
562 		if (!BN_add(r0,r0,rsa->p)) goto err;
563 	if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err;
564 	if (!BN_add(r0,&r1,&m1)) goto err;
565 
566 	if (rsa->e && rsa->n)
567 		{
568 		if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err;
569 		/* If 'I' was greater than (or equal to) rsa->n, the operation
570 		 * will be equivalent to using 'I mod n'. However, the result of
571 		 * the verify will *always* be less than 'n' so we don't check
572 		 * for absolute equality, just congruency. */
573 		if (!BN_sub(&vrfy, &vrfy, I)) goto err;
574 		if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err;
575 		if (vrfy.neg)
576 			if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err;
577 		if (!BN_is_zero(&vrfy))
578 			/* 'I' and 'vrfy' aren't congruent mod n. Don't leak
579 			 * miscalculated CRT output, just do a raw (slower)
580 			 * mod_exp and return that instead. */
581 			if (!rsa->meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err;
582 		}
583 	ret=1;
584 err:
585 	BN_clear_free(&m1);
586 	BN_clear_free(&r1);
587 	BN_clear_free(&vrfy);
588 	BN_CTX_free(ctx);
589 	return(ret);
590 	}
591 
592 static int RSA_eay_init(RSA *rsa)
593 	{
594 	rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE;
595 	return(1);
596 	}
597 
598 static int RSA_eay_finish(RSA *rsa)
599 	{
600 	if (rsa->_method_mod_n != NULL)
601 		BN_MONT_CTX_free(rsa->_method_mod_n);
602 	if (rsa->_method_mod_p != NULL)
603 		BN_MONT_CTX_free(rsa->_method_mod_p);
604 	if (rsa->_method_mod_q != NULL)
605 		BN_MONT_CTX_free(rsa->_method_mod_q);
606 	return(1);
607 	}
608 
609 #endif
610