Crypto.PubKey.RSA.Types

error possible during encryption, decryption or signing.

A blinder, which keeps the timing of the private key operation from saying anything about the number it was given.

The private exponent is not what is at risk. expSafe, which the exponentiation goes through, keeps the value of an exponent out of the work it does.

What a blinder covers is the other side. Without one, the operation runs on the ciphertext as it arrived, so how long it takes depends on a number an attacker may have chosen and can vary -- which is what a remote timing attack on RSA needs. With one, the input is multiplied by a random value first and that value divided out afterwards, so the timing carries nothing an attacker can steer.

Every private key operation here takes a Maybe Blinder. The Safer form of each -- decryptSafer, signSafer and their kind -- generates one and is the one to reach for. Pass Nothing only where the input is not attacker controlled and you have decided that it is not.

A blinder costs one more exponentiation, by the public exponent, which is the cheap direction: measured on an Apple M4, PKCS#1 v1.5 signing goes from about 601 to about 620 microseconds.

Use a blinder once. generateBlinder makes a fresh one; carrying one across operations is not what it is for.

Represent a RSA public key

Represent a RSA private key.

Only the pub, d fields are mandatory to fill.

p, q, dP, dQ, qinv are by-product during RSA generation, but are useful to record here to speed up massively the decrypt and sign operation.

implementations can leave optional fields to 0.

Represent RSA KeyPair

note the RSA private key contains already an instance of public key for efficiency

Public key of a RSA KeyPair

Private key of a RSA KeyPair

get the size in bytes from a private key

get n from a private key

get e from a private key