2 * The RSA public-key cryptosystem
4 * Copyright (C) 2006-2010, Brainspark B.V.
6 * This file is part of PolarSSL (http://www.polarssl.org)
7 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman.
28 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf
29 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf
39 /* *************** begin copy from x509parse.c ********************/
41 * ASN.1 DER decoding routines
43 static int asn1_get_len( unsigned char **p
,
44 const unsigned char *end
,
47 if( ( end
- *p
) < 1 )
48 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
50 if( ( **p
& 0x80 ) == 0 )
57 if( ( end
- *p
) < 2 )
58 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
65 if( ( end
- *p
) < 3 )
66 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
68 *len
= ( (*p
)[1] << 8 ) | (*p
)[2];
73 return( POLARSSL_ERR_ASN1_INVALID_LENGTH
);
78 if( *len
> (int) ( end
- *p
) )
79 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
84 static int asn1_get_tag( unsigned char **p
,
85 const unsigned char *end
,
88 if( ( end
- *p
) < 1 )
89 return( POLARSSL_ERR_ASN1_OUT_OF_DATA
);
92 return( POLARSSL_ERR_ASN1_UNEXPECTED_TAG
);
96 return( asn1_get_len( p
, end
, len
) );
99 static int asn1_get_int( unsigned char **p
,
100 const unsigned char *end
,
105 if( ( ret
= asn1_get_tag( p
, end
, &len
, ASN1_INTEGER
) ) != 0 )
108 if( len
> (int) sizeof( int ) || ( **p
& 0x80 ) != 0 )
109 return( POLARSSL_ERR_ASN1_INVALID_LENGTH
);
115 *val
= ( *val
<< 8 ) | **p
;
122 static int asn1_get_mpi( unsigned char **p
,
123 const unsigned char *end
,
128 if( ( ret
= asn1_get_tag( p
, end
, &len
, ASN1_INTEGER
) ) != 0 )
131 ret
= mpi_read_binary( X
, *p
, len
);
137 /* *************** end copy from x509parse.c ********************/
143 * Initialize an RSA context
145 void rsa_init( rsa_context
*ctx
,
149 memset( ctx
, 0, sizeof( rsa_context
) );
151 ctx
->padding
= padding
;
152 ctx
->hash_id
= hash_id
;
155 #if defined(POLARSSL_GENPRIME)
158 * Generate an RSA keypair
160 int rsa_gen_key( rsa_context
*ctx
,
161 int (*f_rng
)(void *),
163 int nbits
, int exponent
)
168 if( f_rng
== NULL
|| nbits
< 128 || exponent
< 3 )
169 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
171 mpi_init( &P1
, &Q1
, &H
, &G
, NULL
);
174 * find primes P and Q with Q < P so that:
175 * GCD( E, (P-1)*(Q-1) ) == 1
177 MPI_CHK( mpi_lset( &ctx
->E
, exponent
) );
181 MPI_CHK( mpi_gen_prime( &ctx
->P
, ( nbits
+ 1 ) >> 1, 0,
184 MPI_CHK( mpi_gen_prime( &ctx
->Q
, ( nbits
+ 1 ) >> 1, 0,
187 if( mpi_cmp_mpi( &ctx
->P
, &ctx
->Q
) < 0 )
188 mpi_swap( &ctx
->P
, &ctx
->Q
);
190 if( mpi_cmp_mpi( &ctx
->P
, &ctx
->Q
) == 0 )
193 MPI_CHK( mpi_mul_mpi( &ctx
->N
, &ctx
->P
, &ctx
->Q
) );
194 if( mpi_msb( &ctx
->N
) != nbits
)
197 MPI_CHK( mpi_sub_int( &P1
, &ctx
->P
, 1 ) );
198 MPI_CHK( mpi_sub_int( &Q1
, &ctx
->Q
, 1 ) );
199 MPI_CHK( mpi_mul_mpi( &H
, &P1
, &Q1
) );
200 MPI_CHK( mpi_gcd( &G
, &ctx
->E
, &H
) );
202 while( mpi_cmp_int( &G
, 1 ) != 0 );
205 * D = E^-1 mod ((P-1)*(Q-1))
210 MPI_CHK( mpi_inv_mod( &ctx
->D
, &ctx
->E
, &H
) );
211 MPI_CHK( mpi_mod_mpi( &ctx
->DP
, &ctx
->D
, &P1
) );
212 MPI_CHK( mpi_mod_mpi( &ctx
->DQ
, &ctx
->D
, &Q1
) );
213 MPI_CHK( mpi_inv_mod( &ctx
->QP
, &ctx
->Q
, &ctx
->P
) );
215 ctx
->len
= ( mpi_msb( &ctx
->N
) + 7 ) >> 3;
219 mpi_free( &G
, &H
, &Q1
, &P1
, NULL
);
224 return( POLARSSL_ERR_RSA_KEY_GEN_FAILED
| ret
);
233 * Check a public RSA key
235 int rsa_check_pubkey( const rsa_context
*ctx
)
237 if( !ctx
->N
.p
|| !ctx
->E
.p
)
238 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
240 if( ( ctx
->N
.p
[0] & 1 ) == 0 ||
241 ( ctx
->E
.p
[0] & 1 ) == 0 )
242 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
244 if( mpi_msb( &ctx
->N
) < 128 ||
245 mpi_msb( &ctx
->N
) > 4096 )
246 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
248 if( mpi_msb( &ctx
->E
) < 2 ||
249 mpi_msb( &ctx
->E
) > 64 )
250 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
256 * Check a private RSA key
258 int rsa_check_privkey( const rsa_context
*ctx
)
261 mpi PQ
, DE
, P1
, Q1
, H
, I
, G
, G2
, L1
, L2
;
263 if( ( ret
= rsa_check_pubkey( ctx
) ) != 0 )
266 if( !ctx
->P
.p
|| !ctx
->Q
.p
|| !ctx
->D
.p
)
267 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
);
269 mpi_init( &PQ
, &DE
, &P1
, &Q1
, &H
, &I
, &G
, &G2
, &L1
, &L2
, NULL
);
271 MPI_CHK( mpi_mul_mpi( &PQ
, &ctx
->P
, &ctx
->Q
) );
272 MPI_CHK( mpi_mul_mpi( &DE
, &ctx
->D
, &ctx
->E
) );
273 MPI_CHK( mpi_sub_int( &P1
, &ctx
->P
, 1 ) );
274 MPI_CHK( mpi_sub_int( &Q1
, &ctx
->Q
, 1 ) );
275 MPI_CHK( mpi_mul_mpi( &H
, &P1
, &Q1
) );
276 MPI_CHK( mpi_gcd( &G
, &ctx
->E
, &H
) );
278 MPI_CHK( mpi_gcd( &G2
, &P1
, &Q1
) );
279 MPI_CHK( mpi_div_mpi( &L1
, &L2
, &H
, &G2
) );
280 MPI_CHK( mpi_mod_mpi( &I
, &DE
, &L1
) );
283 * Check for a valid PKCS1v2 private key
285 if( mpi_cmp_mpi( &PQ
, &ctx
->N
) == 0 &&
286 mpi_cmp_int( &L2
, 0 ) == 0 &&
287 mpi_cmp_int( &I
, 1 ) == 0 &&
288 mpi_cmp_int( &G
, 1 ) == 0 )
290 mpi_free( &G
, &I
, &H
, &Q1
, &P1
, &DE
, &PQ
, &G2
, &L1
, &L2
, NULL
);
297 mpi_free( &G
, &I
, &H
, &Q1
, &P1
, &DE
, &PQ
, &G2
, &L1
, &L2
, NULL
);
298 return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED
| ret
);
302 * Do an RSA public key operation
304 int rsa_public( rsa_context
*ctx
,
305 const unsigned char *input
,
306 unsigned char *output
)
311 mpi_init( &T
, NULL
);
313 MPI_CHK( mpi_read_binary( &T
, input
, ctx
->len
) );
315 if( mpi_cmp_mpi( &T
, &ctx
->N
) >= 0 )
317 mpi_free( &T
, NULL
);
318 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
322 MPI_CHK( mpi_exp_mod( &T
, &T
, &ctx
->E
, &ctx
->N
, &ctx
->RN
) );
323 MPI_CHK( mpi_write_binary( &T
, output
, olen
) );
327 mpi_free( &T
, NULL
);
330 return( POLARSSL_ERR_RSA_PUBLIC_FAILED
| ret
);
336 * Do an RSA private key operation
338 int rsa_private( rsa_context
*ctx
,
339 const unsigned char *input
,
340 unsigned char *output
)
345 mpi_init( &T
, &T1
, &T2
, NULL
);
347 MPI_CHK( mpi_read_binary( &T
, input
, ctx
->len
) );
349 if( mpi_cmp_mpi( &T
, &ctx
->N
) >= 0 )
351 mpi_free( &T
, NULL
);
352 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
356 MPI_CHK( mpi_exp_mod( &T
, &T
, &ctx
->D
, &ctx
->N
, &ctx
->RN
) );
359 * faster decryption using the CRT
361 * T1 = input ^ dP mod P
362 * T2 = input ^ dQ mod Q
364 MPI_CHK( mpi_exp_mod( &T1
, &T
, &ctx
->DP
, &ctx
->P
, &ctx
->RP
) );
365 MPI_CHK( mpi_exp_mod( &T2
, &T
, &ctx
->DQ
, &ctx
->Q
, &ctx
->RQ
) );
368 * T = (T1 - T2) * (Q^-1 mod P) mod P
370 MPI_CHK( mpi_sub_mpi( &T
, &T1
, &T2
) );
371 MPI_CHK( mpi_mul_mpi( &T1
, &T
, &ctx
->QP
) );
372 MPI_CHK( mpi_mod_mpi( &T
, &T1
, &ctx
->P
) );
375 * output = T2 + T * Q
377 MPI_CHK( mpi_mul_mpi( &T1
, &T
, &ctx
->Q
) );
378 MPI_CHK( mpi_add_mpi( &T
, &T2
, &T1
) );
382 MPI_CHK( mpi_write_binary( &T
, output
, olen
) );
386 mpi_free( &T
, &T1
, &T2
, NULL
);
389 return( POLARSSL_ERR_RSA_PRIVATE_FAILED
| ret
);
395 * Add the message padding, then do an RSA operation
397 int rsa_pkcs1_encrypt( rsa_context
*ctx
,
398 int (*f_rng
)(void *),
401 const unsigned char *input
,
402 unsigned char *output
)
405 unsigned char *p
= output
;
409 switch( ctx
->padding
)
413 if( ilen
< 0 || olen
< ilen
+ 11 || f_rng
== NULL
)
414 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
416 nb_pad
= olen
- 3 - ilen
;
421 while( nb_pad
-- > 0 )
426 *p
= (unsigned char) f_rng( p_rng
);
427 } while( *p
== 0 && --rng_dl
);
429 // Check if RNG failed to generate data
432 return POLARSSL_ERR_RSA_RNG_FAILED
;
437 memcpy( p
, input
, ilen
);
442 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
445 return( ( mode
== RSA_PUBLIC
)
446 ? rsa_public( ctx
, output
, output
)
447 : rsa_private( ctx
, output
, output
) );
451 * Do an RSA operation, then remove the message padding
453 int rsa_pkcs1_decrypt( rsa_context
*ctx
,
455 const unsigned char *input
,
456 unsigned char *output
,
461 unsigned char buf
[1024];
465 if( ilen
< 16 || ilen
> (int) sizeof( buf
) )
466 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
468 ret
= ( mode
== RSA_PUBLIC
)
469 ? rsa_public( ctx
, input
, buf
)
470 : rsa_private( ctx
, input
, buf
);
477 switch( ctx
->padding
)
481 if( *p
++ != 0 || *p
++ != RSA_CRYPT
)
482 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
486 if( p
>= buf
+ ilen
- 1 )
487 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
495 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
498 if (ilen
- (int)(p
- buf
) > output_max_len
)
499 return( POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE
);
501 *olen
= ilen
- (int)(p
- buf
);
502 memcpy( output
, p
, *olen
);
508 * Do an RSA operation to sign the message digest
510 int rsa_pkcs1_sign( rsa_context
*ctx
,
514 const unsigned char *hash
,
518 unsigned char *p
= sig
;
522 switch( ctx
->padding
)
529 nb_pad
= olen
- 3 - hashlen
;
535 nb_pad
= olen
- 3 - 34;
539 nb_pad
= olen
- 3 - 35;
543 nb_pad
= olen
- 3 - 47;
547 nb_pad
= olen
- 3 - 51;
551 nb_pad
= olen
- 3 - 67;
555 nb_pad
= olen
- 3 - 83;
560 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
564 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
568 memset( p
, 0xFF, nb_pad
);
575 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
581 memcpy( p
, hash
, hashlen
);
585 memcpy( p
, ASN1_HASH_MDX
, 18 );
586 memcpy( p
+ 18, hash
, 16 );
590 memcpy( p
, ASN1_HASH_MDX
, 18 );
591 memcpy( p
+ 18, hash
, 16 );
595 memcpy( p
, ASN1_HASH_MDX
, 18 );
596 memcpy( p
+ 18, hash
, 16 );
600 memcpy( p
, ASN1_HASH_SHA1
, 15 );
601 memcpy( p
+ 15, hash
, 20 );
605 memcpy( p
, ASN1_HASH_SHA2X
, 19 );
606 memcpy( p
+ 19, hash
, 28 );
607 p
[1] += 28; p
[14] = 4; p
[18] += 28; break;
610 memcpy( p
, ASN1_HASH_SHA2X
, 19 );
611 memcpy( p
+ 19, hash
, 32 );
612 p
[1] += 32; p
[14] = 1; p
[18] += 32; break;
615 memcpy( p
, ASN1_HASH_SHA2X
, 19 );
616 memcpy( p
+ 19, hash
, 48 );
617 p
[1] += 48; p
[14] = 2; p
[18] += 48; break;
620 memcpy( p
, ASN1_HASH_SHA2X
, 19 );
621 memcpy( p
+ 19, hash
, 64 );
622 p
[1] += 64; p
[14] = 3; p
[18] += 64; break;
625 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
628 return( ( mode
== RSA_PUBLIC
)
629 ? rsa_public( ctx
, sig
, sig
)
630 : rsa_private( ctx
, sig
, sig
) );
634 * Do an RSA operation and check the message digest
636 int rsa_pkcs1_verify( rsa_context
*ctx
,
640 const unsigned char *hash
,
643 int ret
, len
, siglen
;
645 unsigned char buf
[1024];
649 if( siglen
< 16 || siglen
> (int) sizeof( buf
) )
650 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA
);
652 ret
= ( mode
== RSA_PUBLIC
)
653 ? rsa_public( ctx
, sig
, buf
)
654 : rsa_private( ctx
, sig
, buf
);
661 switch( ctx
->padding
)
665 if( *p
++ != 0 || *p
++ != RSA_SIGN
)
666 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
670 if( p
>= buf
+ siglen
- 1 || *p
!= 0xFF )
671 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
679 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
682 len
= siglen
- (int)( p
- buf
);
689 if( memcmp( p
, ASN1_HASH_MDX
, 18 ) != 0 )
690 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
692 if( ( c
== 2 && hash_id
== SIG_RSA_MD2
) ||
693 ( c
== 4 && hash_id
== SIG_RSA_MD4
) ||
694 ( c
== 5 && hash_id
== SIG_RSA_MD5
) )
696 if( memcmp( p
+ 18, hash
, 16 ) == 0 )
699 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
703 if( len
== 35 && hash_id
== SIG_RSA_SHA1
)
705 if( memcmp( p
, ASN1_HASH_SHA1
, 15 ) == 0 &&
706 memcmp( p
+ 15, hash
, 20 ) == 0 )
709 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
711 if( ( len
== 19 + 28 && p
[14] == 4 && hash_id
== SIG_RSA_SHA224
) ||
712 ( len
== 19 + 32 && p
[14] == 1 && hash_id
== SIG_RSA_SHA256
) ||
713 ( len
== 19 + 48 && p
[14] == 2 && hash_id
== SIG_RSA_SHA384
) ||
714 ( len
== 19 + 64 && p
[14] == 3 && hash_id
== SIG_RSA_SHA512
) )
721 memcmp( p
, ASN1_HASH_SHA2X
, 18 ) == 0 &&
722 memcmp( p
+ 19, hash
, c
) == 0 )
725 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
728 if( len
== hashlen
&& hash_id
== SIG_RSA_RAW
)
730 if( memcmp( p
, hash
, hashlen
) == 0 )
733 return( POLARSSL_ERR_RSA_VERIFY_FAILED
);
736 return( POLARSSL_ERR_RSA_INVALID_PADDING
);
740 * Free the components of an RSA key
742 void rsa_free( rsa_context
*ctx
)
744 mpi_free( &ctx
->RQ
, &ctx
->RP
, &ctx
->RN
,
745 &ctx
->QP
, &ctx
->DQ
, &ctx
->DP
,
746 &ctx
->Q
, &ctx
->P
, &ctx
->D
,
747 &ctx
->E
, &ctx
->N
, NULL
);
751 /* PDKIM code (not copied from polarssl) */
753 * Parse a public RSA key
755 OpenSSL RSA public key ASN1 container
756 0:d=0 hl=3 l= 159 cons: SEQUENCE
757 3:d=1 hl=2 l= 13 cons: SEQUENCE
758 5:d=2 hl=2 l= 9 prim: OBJECT:rsaEncryption
759 16:d=2 hl=2 l= 0 prim: NULL
760 18:d=1 hl=3 l= 141 prim: BIT STRING:RSAPublicKey (below)
762 RSAPublicKey ASN1 container
763 0:d=0 hl=3 l= 137 cons: SEQUENCE
764 3:d=1 hl=3 l= 129 prim: INTEGER:Public modulus
765 135:d=1 hl=2 l= 3 prim: INTEGER:Public exponent
768 int rsa_parse_public_key( rsa_context
*rsa
, unsigned char *buf
, int buflen
)
770 unsigned char *p
, *end
;
776 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
777 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 ) {
778 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
781 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
782 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) == 0 ) {
783 /* Skip over embedded rsaEncryption Object */
786 /* The RSAPublicKey ASN1 container is wrapped in a BIT STRING */
787 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
788 ASN1_BIT_STRING
) ) != 0 ) {
789 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
792 /* Limit range to that BIT STRING */
796 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
797 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 ) {
798 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
802 if ( ( ( ret
= asn1_get_mpi( &p
, end
, &(rsa
->N
) ) ) == 0 ) &&
803 ( ( ret
= asn1_get_mpi( &p
, end
, &(rsa
->E
) ) ) == 0 ) ) {
804 rsa
->len
= mpi_size( &rsa
->N
);
808 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
812 * Parse a private RSA key
814 int rsa_parse_key( rsa_context
*rsa
, unsigned char *buf
, int buflen
,
815 unsigned char *pwd
, int pwdlen
)
818 unsigned char *s1
, *s2
;
819 unsigned char *p
, *end
;
821 s1
= (unsigned char *) strstr( (char *) buf
,
822 "-----BEGIN RSA PRIVATE KEY-----" );
826 s2
= (unsigned char *) strstr( (char *) buf
,
827 "-----END RSA PRIVATE KEY-----" );
829 if( s2
== NULL
|| s2
<= s1
)
830 return( POLARSSL_ERR_X509_KEY_INVALID_PEM
);
833 if( *s1
== '\r' ) s1
++;
834 if( *s1
== '\n' ) s1
++;
835 else return( POLARSSL_ERR_X509_KEY_INVALID_PEM
);
839 if( memcmp( s1
, "Proc-Type: 4,ENCRYPTED", 22 ) == 0 )
841 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
);
845 ret
= base64_decode( NULL
, &len
, s1
, s2
- s1
);
847 if( ret
== POLARSSL_ERR_BASE64_INVALID_CHARACTER
)
848 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_PEM
);
850 if( ( buf
= (unsigned char *) malloc( len
) ) == NULL
)
853 if( ( ret
= base64_decode( buf
, &len
, s1
, s2
- s1
) ) != 0 )
856 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_PEM
);
863 return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
);
867 memset( rsa
, 0, sizeof( rsa_context
) );
873 * RSAPrivateKey ::= SEQUENCE {
875 * modulus INTEGER, -- n
876 * publicExponent INTEGER, -- e
877 * privateExponent INTEGER, -- d
878 * prime1 INTEGER, -- p
879 * prime2 INTEGER, -- q
880 * exponent1 INTEGER, -- d mod (p-1)
881 * exponent2 INTEGER, -- d mod (q-1)
882 * coefficient INTEGER, -- (inverse of q) mod p
883 * otherPrimeInfos OtherPrimeInfos OPTIONAL
886 if( ( ret
= asn1_get_tag( &p
, end
, &len
,
887 ASN1_CONSTRUCTED
| ASN1_SEQUENCE
) ) != 0 )
893 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
898 if( ( ret
= asn1_get_int( &p
, end
, &rsa
->ver
) ) != 0 )
904 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
| ret
);
913 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_VERSION
);
916 if( ( ret
= asn1_get_mpi( &p
, end
, &rsa
->N
) ) != 0 ||
917 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->E
) ) != 0 ||
918 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->D
) ) != 0 ||
919 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->P
) ) != 0 ||
920 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->Q
) ) != 0 ||
921 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->DP
) ) != 0 ||
922 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->DQ
) ) != 0 ||
923 ( ret
= asn1_get_mpi( &p
, end
, &rsa
->QP
) ) != 0 )
929 return( ret
| POLARSSL_ERR_X509_KEY_INVALID_FORMAT
);
932 rsa
->len
= mpi_size( &rsa
->N
);
940 return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT
|
941 POLARSSL_ERR_ASN1_LENGTH_MISMATCH
);
944 if( ( ret
= rsa_check_privkey( rsa
) ) != 0 )