[dev.boringcrypto] all: merge master into dev.boringcrypto

[gostls13.git] / src / crypto / rsa / pkcs1v15.go

diff --git a/src/crypto/rsa/pkcs1v15.go b/src/crypto/rsa/pkcs1v15.go
index 3208119ae1ff4707111950cc77673e2f4813a4c8..5475239c6bfe8a8d613a65f80ecb92fe398cb5c2 100644 (file)
--- a/src/crypto/rsa/pkcs1v15.go
+++ b/src/crypto/rsa/pkcs1v15.go
@@ -14,6 +14,8 @@ import (
        "crypto/internal/randutil"
 )
 
+import "crypto/internal/boring"
+
 // This file implements encryption and decryption using PKCS#1 v1.5 padding.
 
 // PKCS1v15DecrypterOpts is for passing options to PKCS#1 v1.5 decryption using
@@ -36,8 +38,8 @@ type PKCS1v15DecryptOptions struct {
 //
 // WARNING: use of this function to encrypt plaintexts other than
 // session keys is dangerous. Use RSA OAEP in new protocols.
-func EncryptPKCS1v15(rand io.Reader, pub *PublicKey, msg []byte) ([]byte, error) {
-       randutil.MaybeReadByte(rand)
+func EncryptPKCS1v15(random io.Reader, pub *PublicKey, msg []byte) ([]byte, error) {
+       randutil.MaybeReadByte(random)
 
        if err := checkPub(pub); err != nil {
                return nil, err
@@ -47,20 +49,37 @@ func EncryptPKCS1v15(rand io.Reader, pub *PublicKey, msg []byte) ([]byte, error)
                return nil, ErrMessageTooLong
        }
 
+       if boring.Enabled && random == boring.RandReader {
+               bkey, err := boringPublicKey(pub)
+               if err != nil {
+                       return nil, err
+               }
+               return boring.EncryptRSAPKCS1(bkey, msg)
+       }
+       boring.UnreachableExceptTests()
+
        // EM = 0x00 || 0x02 || PS || 0x00 || M
        em := make([]byte, k)
        em[1] = 2
        ps, mm := em[2:len(em)-len(msg)-1], em[len(em)-len(msg):]
-       err := nonZeroRandomBytes(ps, rand)
+       err := nonZeroRandomBytes(ps, random)
        if err != nil {
                return nil, err
        }
        em[len(em)-len(msg)-1] = 0
        copy(mm, msg)
 
+       if boring.Enabled {
+               var bkey *boring.PublicKeyRSA
+               bkey, err = boringPublicKey(pub)
+               if err != nil {
+                       return nil, err
+               }
+               return boring.EncryptRSANoPadding(bkey, em)
+       }
+
        m := new(big.Int).SetBytes(em)
        c := encrypt(new(big.Int), pub, m)
-
        return c.FillBytes(em), nil
 }
 
@@ -76,6 +95,19 @@ func DecryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) ([]byt
        if err := checkPub(&priv.PublicKey); err != nil {
                return nil, err
        }
+
+       if boring.Enabled {
+               bkey, err := boringPrivateKey(priv)
+               if err != nil {
+                       return nil, err
+               }
+               out, err := boring.DecryptRSAPKCS1(bkey, ciphertext)
+               if err != nil {
+                       return nil, ErrDecryption
+               }
+               return out, nil
+       }
+
        valid, out, index, err := decryptPKCS1v15(rand, priv, ciphertext)
        if err != nil {
                return nil, err
@@ -143,13 +175,26 @@ func decryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) (valid
                return
        }
 
-       c := new(big.Int).SetBytes(ciphertext)
-       m, err := decrypt(rand, priv, c)
-       if err != nil {
-               return
+       if boring.Enabled {
+               var bkey *boring.PrivateKeyRSA
+               bkey, err = boringPrivateKey(priv)
+               if err != nil {
+                       return
+               }
+               em, err = boring.DecryptRSANoPadding(bkey, ciphertext)
+               if err != nil {
+                       return
+               }
+       } else {
+               c := new(big.Int).SetBytes(ciphertext)
+               var m *big.Int
+               m, err = decrypt(rand, priv, c)
+               if err != nil {
+                       return
+               }
+               em = m.FillBytes(make([]byte, k))
        }
 
-       em = m.FillBytes(make([]byte, k))
        firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0)
        secondByteIsTwo := subtle.ConstantTimeByteEq(em[1], 2)
 
@@ -228,7 +273,7 @@ var hashPrefixes = map[crypto.Hash][]byte{
 // messages is small, an attacker may be able to build a map from
 // messages to signatures and identify the signed messages. As ever,
 // signatures provide authenticity, not confidentiality.
-func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
+func SignPKCS1v15(random io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
        hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
        if err != nil {
                return nil, err
@@ -240,6 +285,14 @@ func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []b
                return nil, ErrMessageTooLong
        }
 
+       if boring.Enabled {
+               bkey, err := boringPrivateKey(priv)
+               if err != nil {
+                       return nil, err
+               }
+               return boring.SignRSAPKCS1v15(bkey, hash, hashed)
+       }
+
        // EM = 0x00 || 0x01 || PS || 0x00 || T
        em := make([]byte, k)
        em[1] = 1
@@ -250,7 +303,7 @@ func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []b
        copy(em[k-hashLen:k], hashed)
 
        m := new(big.Int).SetBytes(em)
-       c, err := decryptAndCheck(rand, priv, m)
+       c, err := decryptAndCheck(random, priv, m)
        if err != nil {
                return nil, err
        }
@@ -264,6 +317,17 @@ func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []b
 // returning a nil error. If hash is zero then hashed is used directly. This
 // isn't advisable except for interoperability.
 func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte) error {
+       if boring.Enabled {
+               bkey, err := boringPublicKey(pub)
+               if err != nil {
+                       return err
+               }
+               if err := boring.VerifyRSAPKCS1v15(bkey, hash, hashed, sig); err != nil {
+                       return ErrVerification
+               }
+               return nil
+       }
+
        hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
        if err != nil {
                return err