Crypto.PubKey.RSA.PKCS15

This produce a standard PKCS1.5 padding for encryption

Produce a standard PKCS1.5 padding for signature

Try to remove a standard PKCS1.5 encryption padding.

The block is scanned in full rather than up to the octet ending the padding string, so how long that string is does not show up in how long this takes.

What remains visible is the result itself: whether the padding was well formed, and the length of the message when it was. That is inherent to the scheme, and it is the signal Bleichenbacher's attack needs, so a caller that decrypts attacker-supplied ciphertext must not pass the distinction on -- TLS, for instance, continues with a random premaster secret and reports nothing.

decrypt message using the private key.

The blinder is optional and Nothing is accepted, but see Blinder for what it covers and when leaving it out is a decision rather than a default. decryptSafer generates one for you.

The message is returned un-padded.

Following RFC 8017, the ciphertext is rejected unless it is exactly as long as the modulus (section 7.2.2, step 1) and its integer representative is below the modulus (RSADP, section 5.1.2, step 1). The decryption primitive normalises any multiple of the modulus away, so without the second check c + n would decrypt to the same message as c, and a ciphertext would not be unique to its plaintext. Both checks are made on the ciphertext alone, which is public, and report MessageSizeIncorrect.

decrypt message using the private key and by automatically generating a blinder.

sign message using private key, a hash and its ASN1 description

The blinder is optional and Nothing is accepted, but see Blinder for what it covers and when leaving it out is a decision rather than a default. signSafer generates one for you.

sign message using the private key and by automatically generating a blinder.

encrypt a bytestring using the public key.

The message needs to be smaller than the key size - 11. The message should not be padded.

verify message with the signed message

Following RFC 8017, the signature is rejected unless it is exactly as long as the modulus (section 8.2.2, step 1) and its integer representative is below the modulus (section 5.2.2, step 1). Verification works by re-encoding the expected signature and comparing it with the result of the public-key operation, and that operation normalises away both the length of the encoding and any multiple of the modulus; without these checks a zero-padded signature, or s + n, would verify just as well as s.

A specialized class for hash algorithm that can product a ASN1 wrapped description the algorithm plus the content of the digest.