1 /* crypto/rsa/rsa_eay.c */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 #include "cryptlib.h" 61 #include <openssl/bn.h> 62 #include <openssl/rsa.h> 63 #include <openssl/rand.h> 64 #include <openssl/engine.h> 65 66 #ifndef RSA_NULL 67 68 static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 69 unsigned char *to, RSA *rsa,int padding); 70 static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 71 unsigned char *to, RSA *rsa,int padding); 72 static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 73 unsigned char *to, RSA *rsa,int padding); 74 static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 75 unsigned char *to, RSA *rsa,int padding); 76 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa); 77 static int RSA_eay_init(RSA *rsa); 78 static int RSA_eay_finish(RSA *rsa); 79 static RSA_METHOD rsa_pkcs1_eay_meth={ 80 "Eric Young's PKCS#1 RSA", 81 RSA_eay_public_encrypt, 82 RSA_eay_public_decrypt, /* signature verification */ 83 RSA_eay_private_encrypt, /* signing */ 84 RSA_eay_private_decrypt, 85 RSA_eay_mod_exp, 86 BN_mod_exp_mont, /* XXX probably we should not use Montgomery if e == 3 */ 87 RSA_eay_init, 88 RSA_eay_finish, 89 0, /* flags */ 90 NULL, 91 0, /* rsa_sign */ 92 0 /* rsa_verify */ 93 }; 94 95 const RSA_METHOD *RSA_PKCS1_SSLeay(void) 96 { 97 return(&rsa_pkcs1_eay_meth); 98 } 99 100 static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 101 unsigned char *to, RSA *rsa, int padding) 102 { 103 BIGNUM f,ret; 104 int i,j,k,num=0,r= -1; 105 unsigned char *buf=NULL; 106 BN_CTX *ctx=NULL; 107 108 BN_init(&f); 109 BN_init(&ret); 110 if ((ctx=BN_CTX_new()) == NULL) goto err; 111 num=BN_num_bytes(rsa->n); 112 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 113 { 114 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE); 115 goto err; 116 } 117 118 switch (padding) 119 { 120 case RSA_PKCS1_PADDING: 121 i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen); 122 break; 123 #ifndef OPENSSL_NO_SHA 124 case RSA_PKCS1_OAEP_PADDING: 125 i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0); 126 break; 127 #endif 128 case RSA_SSLV23_PADDING: 129 i=RSA_padding_add_SSLv23(buf,num,from,flen); 130 break; 131 case RSA_NO_PADDING: 132 i=RSA_padding_add_none(buf,num,from,flen); 133 break; 134 default: 135 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 136 goto err; 137 } 138 if (i <= 0) goto err; 139 140 if (BN_bin2bn(buf,num,&f) == NULL) goto err; 141 142 if (BN_ucmp(&f, rsa->n) >= 0) 143 { 144 /* usually the padding functions would catch this */ 145 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 146 goto err; 147 } 148 149 if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC)) 150 { 151 BN_MONT_CTX* bn_mont_ctx; 152 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 153 goto err; 154 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx)) 155 { 156 BN_MONT_CTX_free(bn_mont_ctx); 157 goto err; 158 } 159 if (rsa->_method_mod_n == NULL) /* other thread may have finished first */ 160 { 161 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 162 if (rsa->_method_mod_n == NULL) 163 { 164 rsa->_method_mod_n = bn_mont_ctx; 165 bn_mont_ctx = NULL; 166 } 167 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 168 } 169 if (bn_mont_ctx) 170 BN_MONT_CTX_free(bn_mont_ctx); 171 } 172 173 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, 174 rsa->_method_mod_n)) goto err; 175 176 /* put in leading 0 bytes if the number is less than the 177 * length of the modulus */ 178 j=BN_num_bytes(&ret); 179 i=BN_bn2bin(&ret,&(to[num-j])); 180 for (k=0; k<(num-i); k++) 181 to[k]=0; 182 183 r=num; 184 err: 185 if (ctx != NULL) BN_CTX_free(ctx); 186 BN_clear_free(&f); 187 BN_clear_free(&ret); 188 if (buf != NULL) 189 { 190 memset(buf,0,num); 191 OPENSSL_free(buf); 192 } 193 return(r); 194 } 195 196 /* signing */ 197 static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 198 unsigned char *to, RSA *rsa, int padding) 199 { 200 BIGNUM f,ret; 201 int i,j,k,num=0,r= -1; 202 unsigned char *buf=NULL; 203 BN_CTX *ctx=NULL; 204 205 BN_init(&f); 206 BN_init(&ret); 207 208 if ((ctx=BN_CTX_new()) == NULL) goto err; 209 num=BN_num_bytes(rsa->n); 210 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 211 { 212 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE); 213 goto err; 214 } 215 216 switch (padding) 217 { 218 case RSA_PKCS1_PADDING: 219 i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen); 220 break; 221 case RSA_NO_PADDING: 222 i=RSA_padding_add_none(buf,num,from,flen); 223 break; 224 case RSA_SSLV23_PADDING: 225 default: 226 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 227 goto err; 228 } 229 if (i <= 0) goto err; 230 231 if (BN_bin2bn(buf,num,&f) == NULL) goto err; 232 233 if (BN_ucmp(&f, rsa->n) >= 0) 234 { 235 /* usually the padding functions would catch this */ 236 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 237 goto err; 238 } 239 240 if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) 241 RSA_blinding_on(rsa,ctx); 242 if (rsa->flags & RSA_FLAG_BLINDING) 243 if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; 244 245 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 246 ((rsa->p != NULL) && 247 (rsa->q != NULL) && 248 (rsa->dmp1 != NULL) && 249 (rsa->dmq1 != NULL) && 250 (rsa->iqmp != NULL)) ) 251 { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } 252 else 253 { 254 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err; 255 } 256 257 if (rsa->flags & RSA_FLAG_BLINDING) 258 if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; 259 260 /* put in leading 0 bytes if the number is less than the 261 * length of the modulus */ 262 j=BN_num_bytes(&ret); 263 i=BN_bn2bin(&ret,&(to[num-j])); 264 for (k=0; k<(num-i); k++) 265 to[k]=0; 266 267 r=num; 268 err: 269 if (ctx != NULL) BN_CTX_free(ctx); 270 BN_clear_free(&ret); 271 BN_clear_free(&f); 272 if (buf != NULL) 273 { 274 memset(buf,0,num); 275 OPENSSL_free(buf); 276 } 277 return(r); 278 } 279 280 static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 281 unsigned char *to, RSA *rsa, int padding) 282 { 283 BIGNUM f,ret; 284 int j,num=0,r= -1; 285 unsigned char *p; 286 unsigned char *buf=NULL; 287 BN_CTX *ctx=NULL; 288 289 BN_init(&f); 290 BN_init(&ret); 291 ctx=BN_CTX_new(); 292 if (ctx == NULL) goto err; 293 294 num=BN_num_bytes(rsa->n); 295 296 if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) 297 { 298 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE); 299 goto err; 300 } 301 302 /* This check was for equality but PGP does evil things 303 * and chops off the top '0' bytes */ 304 if (flen > num) 305 { 306 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 307 goto err; 308 } 309 310 /* make data into a big number */ 311 if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err; 312 313 if (BN_ucmp(&f, rsa->n) >= 0) 314 { 315 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 316 goto err; 317 } 318 319 if ((rsa->flags & RSA_FLAG_BLINDING) && (rsa->blinding == NULL)) 320 RSA_blinding_on(rsa,ctx); 321 if (rsa->flags & RSA_FLAG_BLINDING) 322 if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; 323 324 /* do the decrypt */ 325 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 326 ((rsa->p != NULL) && 327 (rsa->q != NULL) && 328 (rsa->dmp1 != NULL) && 329 (rsa->dmq1 != NULL) && 330 (rsa->iqmp != NULL)) ) 331 { if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } 332 else 333 { 334 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) 335 goto err; 336 } 337 338 if (rsa->flags & RSA_FLAG_BLINDING) 339 if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; 340 341 p=buf; 342 j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */ 343 344 switch (padding) 345 { 346 case RSA_PKCS1_PADDING: 347 r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num); 348 break; 349 #ifndef OPENSSL_NO_SHA 350 case RSA_PKCS1_OAEP_PADDING: 351 r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0); 352 break; 353 #endif 354 case RSA_SSLV23_PADDING: 355 r=RSA_padding_check_SSLv23(to,num,buf,j,num); 356 break; 357 case RSA_NO_PADDING: 358 r=RSA_padding_check_none(to,num,buf,j,num); 359 break; 360 default: 361 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 362 goto err; 363 } 364 if (r < 0) 365 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 366 367 err: 368 if (ctx != NULL) BN_CTX_free(ctx); 369 BN_clear_free(&f); 370 BN_clear_free(&ret); 371 if (buf != NULL) 372 { 373 memset(buf,0,num); 374 OPENSSL_free(buf); 375 } 376 return(r); 377 } 378 379 /* signature verification */ 380 static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 381 unsigned char *to, RSA *rsa, int padding) 382 { 383 BIGNUM f,ret; 384 int i,num=0,r= -1; 385 unsigned char *p; 386 unsigned char *buf=NULL; 387 BN_CTX *ctx=NULL; 388 389 BN_init(&f); 390 BN_init(&ret); 391 ctx=BN_CTX_new(); 392 if (ctx == NULL) goto err; 393 394 num=BN_num_bytes(rsa->n); 395 buf=(unsigned char *)OPENSSL_malloc(num); 396 if (buf == NULL) 397 { 398 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE); 399 goto err; 400 } 401 402 /* This check was for equality but PGP does evil things 403 * and chops off the top '0' bytes */ 404 if (flen > num) 405 { 406 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 407 goto err; 408 } 409 410 if (BN_bin2bn(from,flen,&f) == NULL) goto err; 411 412 if (BN_ucmp(&f, rsa->n) >= 0) 413 { 414 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 415 goto err; 416 } 417 418 /* do the decrypt */ 419 if ((rsa->_method_mod_n == NULL) && (rsa->flags & RSA_FLAG_CACHE_PUBLIC)) 420 { 421 BN_MONT_CTX* bn_mont_ctx; 422 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 423 goto err; 424 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->n,ctx)) 425 { 426 BN_MONT_CTX_free(bn_mont_ctx); 427 goto err; 428 } 429 if (rsa->_method_mod_n == NULL) /* other thread may have finished first */ 430 { 431 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 432 if (rsa->_method_mod_n == NULL) 433 { 434 rsa->_method_mod_n = bn_mont_ctx; 435 bn_mont_ctx = NULL; 436 } 437 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 438 } 439 if (bn_mont_ctx) 440 BN_MONT_CTX_free(bn_mont_ctx); 441 } 442 443 if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, 444 rsa->_method_mod_n)) goto err; 445 446 p=buf; 447 i=BN_bn2bin(&ret,p); 448 449 switch (padding) 450 { 451 case RSA_PKCS1_PADDING: 452 r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num); 453 break; 454 case RSA_NO_PADDING: 455 r=RSA_padding_check_none(to,num,buf,i,num); 456 break; 457 default: 458 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 459 goto err; 460 } 461 if (r < 0) 462 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 463 464 err: 465 if (ctx != NULL) BN_CTX_free(ctx); 466 BN_clear_free(&f); 467 BN_clear_free(&ret); 468 if (buf != NULL) 469 { 470 memset(buf,0,num); 471 OPENSSL_free(buf); 472 } 473 return(r); 474 } 475 476 static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) 477 { 478 BIGNUM r1,m1,vrfy; 479 int ret=0; 480 BN_CTX *ctx; 481 482 BN_init(&m1); 483 BN_init(&r1); 484 BN_init(&vrfy); 485 if ((ctx=BN_CTX_new()) == NULL) goto err; 486 487 if (rsa->flags & RSA_FLAG_CACHE_PRIVATE) 488 { 489 if (rsa->_method_mod_p == NULL) 490 { 491 BN_MONT_CTX* bn_mont_ctx; 492 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 493 goto err; 494 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->p,ctx)) 495 { 496 BN_MONT_CTX_free(bn_mont_ctx); 497 goto err; 498 } 499 if (rsa->_method_mod_p == NULL) /* other thread may have finished first */ 500 { 501 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 502 if (rsa->_method_mod_p == NULL) 503 { 504 rsa->_method_mod_p = bn_mont_ctx; 505 bn_mont_ctx = NULL; 506 } 507 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 508 } 509 if (bn_mont_ctx) 510 BN_MONT_CTX_free(bn_mont_ctx); 511 } 512 513 if (rsa->_method_mod_q == NULL) 514 { 515 BN_MONT_CTX* bn_mont_ctx; 516 if ((bn_mont_ctx=BN_MONT_CTX_new()) == NULL) 517 goto err; 518 if (!BN_MONT_CTX_set(bn_mont_ctx,rsa->q,ctx)) 519 { 520 BN_MONT_CTX_free(bn_mont_ctx); 521 goto err; 522 } 523 if (rsa->_method_mod_q == NULL) /* other thread may have finished first */ 524 { 525 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 526 if (rsa->_method_mod_q == NULL) 527 { 528 rsa->_method_mod_q = bn_mont_ctx; 529 bn_mont_ctx = NULL; 530 } 531 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 532 } 533 if (bn_mont_ctx) 534 BN_MONT_CTX_free(bn_mont_ctx); 535 } 536 } 537 538 if (!BN_mod(&r1,I,rsa->q,ctx)) goto err; 539 if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx, 540 rsa->_method_mod_q)) goto err; 541 542 if (!BN_mod(&r1,I,rsa->p,ctx)) goto err; 543 if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx, 544 rsa->_method_mod_p)) goto err; 545 546 if (!BN_sub(r0,r0,&m1)) goto err; 547 /* This will help stop the size of r0 increasing, which does 548 * affect the multiply if it optimised for a power of 2 size */ 549 if (r0->neg) 550 if (!BN_add(r0,r0,rsa->p)) goto err; 551 552 if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err; 553 if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err; 554 /* If p < q it is occasionally possible for the correction of 555 * adding 'p' if r0 is negative above to leave the result still 556 * negative. This can break the private key operations: the following 557 * second correction should *always* correct this rare occurrence. 558 * This will *never* happen with OpenSSL generated keys because 559 * they ensure p > q [steve] 560 */ 561 if (r0->neg) 562 if (!BN_add(r0,r0,rsa->p)) goto err; 563 if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err; 564 if (!BN_add(r0,&r1,&m1)) goto err; 565 566 if (rsa->e && rsa->n) 567 { 568 if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err; 569 /* If 'I' was greater than (or equal to) rsa->n, the operation 570 * will be equivalent to using 'I mod n'. However, the result of 571 * the verify will *always* be less than 'n' so we don't check 572 * for absolute equality, just congruency. */ 573 if (!BN_sub(&vrfy, &vrfy, I)) goto err; 574 if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err; 575 if (vrfy.neg) 576 if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err; 577 if (!BN_is_zero(&vrfy)) 578 /* 'I' and 'vrfy' aren't congruent mod n. Don't leak 579 * miscalculated CRT output, just do a raw (slower) 580 * mod_exp and return that instead. */ 581 if (!rsa->meth->bn_mod_exp(r0,I,rsa->d,rsa->n,ctx,NULL)) goto err; 582 } 583 ret=1; 584 err: 585 BN_clear_free(&m1); 586 BN_clear_free(&r1); 587 BN_clear_free(&vrfy); 588 BN_CTX_free(ctx); 589 return(ret); 590 } 591 592 static int RSA_eay_init(RSA *rsa) 593 { 594 rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE; 595 return(1); 596 } 597 598 static int RSA_eay_finish(RSA *rsa) 599 { 600 if (rsa->_method_mod_n != NULL) 601 BN_MONT_CTX_free(rsa->_method_mod_n); 602 if (rsa->_method_mod_p != NULL) 603 BN_MONT_CTX_free(rsa->_method_mod_p); 604 if (rsa->_method_mod_q != NULL) 605 BN_MONT_CTX_free(rsa->_method_mod_q); 606 return(1); 607 } 608 609 #endif 610