Repository navigation
Store primes as Odd<BoxedUint> - #735
Merged
Merged
Conversation
Checked at construction time in a fallible constructor, so we can pass the primes directly as a modulus or use `as_nz_ref` to obtain `NonZero`.
tarcieri
added a commit
that referenced
this pull request
Oct 24, 2026
Test `crt_coefficient()` and the coefficient encoded in PKCS#1 DER with primes of different storage precisions, covering both prime orderings and with/without precomputation. Covers the precision mismatch fixed by #735 and crypto-bigint v0.7.7
kaidokert
added a commit
to kaidokert/RSA
that referenced
this pull request
Nov 6, 2026
* Raise the crypto-bigint floor to 0.7.10 Upstream now requires 0.7.10, and the zeroizable `MontyParams<BoxedUint>` used for the CRT primes comes with that series. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Add `SecretPrime` type alias (RustCrypto#716) Partially resolves the zeroization problems around `PrecomputedValues` by storing `p` and `q` as `MontyParams<BoxedUint>`, which avoids the problems surrounding the `Arc`. It doesn't completely address the issue though, as several APIs still need a proper `BoxedMontyParams` input which we don't yet erase. We need to provide an API that's able to obtain exclusive access to the `Arc` in certain cases that can erase these intermediates, but for now this at least allows the `Zeroize` impl for `PrecomputedValues` to be complete. Fork adaptation: `p()`/`q()` replace `p_params()`/`q_params()` on the generic `PrivateKeyParts<T>`, alloc-gated and defaulting to `None`. (cherry picked from commit 4506828) * Store primes as `Odd<BoxedUint>` (RustCrypto#735) Checked at construction time in a fallible constructor, so we can pass the primes directly as a modulus or use `as_nz_ref` to obtain `NonZero`. Fork adaptation: the generic `PrivateKeyParts<T>::primes` returns `&[Odd<BoxedUint>]` on alloc and defaults to empty; only `BoxedUint` keys store primes. The checkct part comes with the checkct port. (cherry picked from commit f128327) * rustdoc: wording fixup (RustCrypto#736) Fork adaptation: wording applied to the generic `PrivateKeyParts<T>::primes`. (cherry picked from commit f32be6f) * Add CRT coefficient regression tests (RustCrypto#737) Test `crt_coefficient()` and the coefficient encoded in PKCS#1 DER with primes of different storage precisions, covering both prime orderings and with/without precomputation. Covers the precision mismatch fixed by RustCrypto#735 and crypto-bigint v0.7.7 Fork adaptation: gated on `alloc`. (cherry picked from commit 528145a) * Reject private exponents greater or equal to `n` (RustCrypto#738) Enforce the RFC8017 section 3.2 requirement that d < n during shared private-key validation. The existing RSA congruence checks alone accept larger equivalent exponents. (cherry picked from commit 412a242) * Resize `d` to match the precision of `n` (RustCrypto#751) Normalize `d` (private key) to the precision of the public modulus `n` as recommended in §6.2.1 of draft-irtf-cfrg-rsa-guidance-10. Fork adaptation: struct field docs kept on the generic `GenericRsaPrivateKey`. (cherry picked from commit 8e97e88) * Use `rem` instead of `rem_vartime` on secret components (RustCrypto#752) Fixes item 4 from RustCrypto#711 (cherry picked from commit 2e60745) * Choose private prime and CRT exponent widths from public parameters (RustCrypto#755) Use `ceil(bit_length(n)/2)` as the default two-prime bound and normalize both factors and their CRT exponents to that precision. Use modulus-width factors for multiprime keys, which already use non-CRT operations. Also adds an explicit `RsaPrivateKey::from_components_with_wide_primes` constructor for cases where primes do not have this property. Fork adaptation: the checkct part comes with the checkct port. (cherry picked from commit 8eb9e4c) * Reduce CRT inputs with fixed-width Montgomery arithmetic (RustCrypto#756) Replace the private operation reductions mod `p` and `q` and precomputed `q` mod `p` with Montgomery conversions over public-sized chunks. Also adds `checkct` for the reduction helper for secret moduli. Fork adaptation: the alloc `IntoMontyForm::from_value` uses the new `reduction::to_monty`, so the generic `rsa::to_monty` (also used by the modmath backends) gets the same division-free reduction. The checkct part comes with the checkct port. (cherry picked from commit 079f22a) * Reject repeated prime factors in private keys (RustCrypto#772) We previously checked for these during key generation but not in e.g. the component-based constructor. This moves the checks to the constructor, so they're applied to all keys, not just ones produced via random generation. Fork adaptation: the key generation test is gated on `keygen`. (cherry picked from commit 28ae504) * Reject even modulus factors (RustCrypto#774) Followup to a regression introduced in RustCrypto#772 which accidentally removed these checks (cherry picked from commit 8032fe8) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Tony Arcieri <bascule@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checked at construction time in a fallible constructor, so we can pass the primes directly as a modulus or use
as_nz_refto obtainNonZero.