[WIP]: switch to crypto-bigint for decryption

Cargo.toml

@@ -25,6 +25,7 @@ pkcs8 = { version = "0.10.2", default-features = false, features = ["alloc"] }
 signature = { version = ">2.0, <2.3", default-features = false , features = ["alloc", "digest", "rand_core"] }
 spki = { version = "0.7.2", default-features = false, features = ["alloc"] }
 zeroize = { version = "1.5", features = ["alloc"] }
+crypto-bigint = { version = "0.6.0-pre.0", features = ["zeroize", "alloc"] }
 
 # optional dependencies
 sha1 = { version = "0.10.5", optional = true, default-features = false, features = ["oid"] }
@@ -64,3 +65,6 @@ rustdoc-args = ["--cfg", "docsrs"]
 
 [profile.dev]
 opt-level = 2
+
+[patch.crates-io]
+crypto-bigint = { git = "https://github.com/RustCrypto/crypto-bigint", branch = "master" }

src/algorithms/rsa.rs

@@ -1,15 +1,19 @@
 //! Generic RSA implementation
 
-use alloc::borrow::Cow;
 use alloc::vec::Vec;
-use num_bigint::{BigInt, BigUint, IntoBigInt, IntoBigUint, ModInverse, RandBigInt, ToBigInt};
+use crypto_bigint::modular::{BoxedResidue, BoxedResidueParams};
+use crypto_bigint::{BoxedUint, RandomMod};
+use num_bigint::{BigUint, IntoBigInt, IntoBigUint, ModInverse, ToBigInt};
 use num_integer::{sqrt, Integer};
-use num_traits::{FromPrimitive, One, Pow, Signed, Zero};
+use num_traits::{FromPrimitive, One, Pow, Signed, Zero as _};
 use rand_core::CryptoRngCore;
+use subtle::CtOption;
 use zeroize::{Zeroize, Zeroizing};
 
 use crate::errors::{Error, Result};
-use crate::traits::{PrivateKeyParts, PublicKeyParts};
+use crate::key::{reduce, to_biguint, to_uint_exact};
+use crate::traits::keys::{PrivateKeyPartsNew, PublicKeyPartsNew};
+use crate::traits::PublicKeyParts;
 
 /// ⚠️ Raw RSA encryption of m with the public key. No padding is performed.
 ///
@@ -19,7 +23,7 @@ use crate::traits::{PrivateKeyParts, PublicKeyParts};
 /// or signature scheme. See the [module-level documentation][crate::hazmat] for more information.
 #[inline]
 pub fn rsa_encrypt<K: PublicKeyParts>(key: &K, m: &BigUint) -> Result<BigUint> {
-    Ok(m.modpow(key.e(), key.n()))
+    Ok(m.modpow(&key.e(), &key.n()))
 }
 
 /// ⚠️ Performs raw RSA decryption with no padding or error checking.
@@ -33,25 +37,38 @@ pub fn rsa_encrypt<K: PublicKeyParts>(key: &K, m: &BigUint) -> Result<BigUint> {
 #[inline]
 pub fn rsa_decrypt<R: CryptoRngCore + ?Sized>(
     mut rng: Option<&mut R>,
-    priv_key: &impl PrivateKeyParts,
-    c: &BigUint,
+    priv_key: &impl PrivateKeyPartsNew,
+    c_orig: &BigUint,
 ) -> Result<BigUint> {
-    if c >= priv_key.n() {
+    let n = priv_key.n();
+    let nbits = n.bits_precision();
+    let c = to_uint_exact(c_orig.clone(), nbits);
+    let d = priv_key.d();
+
+    std::dbg!(nbits, d.bits_precision(), c.bits_precision());
+
+    if c >= **n {
         return Err(Error::Decryption);
     }
 
-    if priv_key.n().is_zero() {
+    // TODO: is this fine?
+    if n.is_zero().into() {
         return Err(Error::Decryption);
     }
 
     let mut ir = None;
 
+    let n_params = priv_key
+        .residue_params()
+        .cloned()
+        .unwrap_or_else(|| BoxedResidueParams::new(n.clone().get()).unwrap());
+
     let c = if let Some(ref mut rng) = rng {
-        let (blinded, unblinder) = blind(rng, priv_key, c);
+        let (blinded, unblinder) = blind(rng, priv_key, &c, &n_params);
         ir = Some(unblinder);
-        Cow::Owned(blinded)
+        blinded
     } else {
-        Cow::Borrowed(c)
+        c
     };
 
     let dp = priv_key.dp();
@@ -63,19 +80,21 @@ pub fn rsa_decrypt<R: CryptoRngCore + ?Sized>(
         (Some(dp), Some(dq), Some(qinv), Some(crt_values)) => {
             // We have the precalculated values needed for the CRT.
 
-            let p = &priv_key.primes()[0];
-            let q = &priv_key.primes()[1];
+            let dp = to_biguint(dp);
+            let dq = to_biguint(dq);
+            let qinv = to_biguint(qinv).to_bigint().unwrap();
+            let p = to_biguint(&priv_key.primes()[0]);
+            let q = to_biguint(&priv_key.primes()[1]);
 
-            let mut m = c.modpow(dp, p).into_bigint().unwrap();
-            let mut m2 = c.modpow(dq, q).into_bigint().unwrap();
+            let mut m = c_orig.modpow(&dp, &p).into_bigint().unwrap();
+            let mut m2 = c_orig.modpow(&dq, &q).into_bigint().unwrap();
 
             m -= &m2;
 
             let mut primes: Vec<_> = priv_key
                 .primes()
                 .iter()
-                .map(ToBigInt::to_bigint)
-                .map(Option::unwrap)
+                .map(|p| to_biguint(p).to_bigint().unwrap())
                 .collect();
 
             while m.is_negative() {
@@ -86,17 +105,17 @@ pub fn rsa_decrypt<R: CryptoRngCore + ?Sized>(
             m *= &primes[1];
             m += &m2;
 
-            let mut c = c.into_owned().into_bigint().unwrap();
+            let mut c = c_orig.to_bigint().unwrap();
             for (i, value) in crt_values.iter().enumerate() {
                 let prime = &primes[2 + i];
-                m2 = c.modpow(&value.exp, prime);
+                m2 = c.modpow(&to_biguint(&value.exp).to_bigint().unwrap(), prime);
                 m2 -= &m;
-                m2 *= &value.coeff;
+                m2 *= &to_biguint(&value.coeff).to_bigint().unwrap();
                 m2 %= prime;
                 while m2.is_negative() {
                     m2 += prime;
                 }
-                m2 *= &value.r;
+                m2 *= &to_biguint(&value.r).to_bigint().unwrap();
                 m += &m2;
             }
 
@@ -108,17 +127,21 @@ pub fn rsa_decrypt<R: CryptoRngCore + ?Sized>(
             c.zeroize();
             m2.zeroize();
 
-            m.into_biguint().expect("failed to decrypt")
+            to_uint_exact(m.into_biguint().expect("failed to decrypt"), nbits)
+        }
+        _ => {
+            let c = reduce(&c, n_params.clone());
+            c.pow(&d).retrieve()
         }
-        _ => c.modpow(priv_key.d(), priv_key.n()),
     };
 
     match ir {
         Some(ref ir) => {
             // unblind
-            Ok(unblind(priv_key, &m, ir))
+            let res = to_biguint(&unblind(&m, ir, n_params));
+            Ok(res)
         }
-        None => Ok(m),
+        None => Ok(to_biguint(&m)),
     }
 }
 
@@ -133,7 +156,7 @@ pub fn rsa_decrypt<R: CryptoRngCore + ?Sized>(
 /// or signature scheme. See the [module-level documentation][crate::hazmat] for more information.
 #[inline]
 pub fn rsa_decrypt_and_check<R: CryptoRngCore + ?Sized>(
-    priv_key: &impl PrivateKeyParts,
+    priv_key: &impl PrivateKeyPartsNew,
     rng: Option<&mut R>,
     c: &BigUint,
 ) -> Result<BigUint> {
@@ -151,38 +174,40 @@ pub fn rsa_decrypt_and_check<R: CryptoRngCore + ?Sized>(
 }
 
 /// Returns the blinded c, along with the unblinding factor.
-fn blind<R: CryptoRngCore, K: PublicKeyParts>(
+fn blind<R: CryptoRngCore, K: PublicKeyPartsNew>(
     rng: &mut R,
     key: &K,
-    c: &BigUint,
-) -> (BigUint, BigUint) {
+    c: &BoxedUint,
+    n_params: &BoxedResidueParams,
+) -> (BoxedUint, BoxedUint) {
     // Blinding involves multiplying c by r^e.
     // Then the decryption operation performs (m^e * r^e)^d mod n
     // which equals mr mod n. The factor of r can then be removed
     // by multiplying by the multiplicative inverse of r.
 
-    let mut r: BigUint;
-    let mut ir: Option<BigInt>;
+    let mut r: BoxedUint;
+    let mut ir: CtOption<BoxedUint>;
     let unblinder;
     loop {
-        r = rng.gen_biguint_below(key.n());
-        if r.is_zero() {
-            r = BigUint::one();
+        // TODO: use constant time gen
+        r = BoxedUint::random_mod(rng, key.n());
+        // TODO: correct mapping
+        if r.is_zero().into() {
+            r = BoxedUint::one();
         }
-        ir = r.clone().mod_inverse(key.n());
-        if let Some(ir) = ir {
-            if let Some(ub) = ir.into_biguint() {
-                unblinder = ub;
-                break;
-            }
+        ir = r.inv_mod(key.n());
+
+        // TODO: constant time?
+        if let Some(ir) = ir.into() {
+            unblinder = ir;
+            break;
         }
     }
 
     let c = {
-        let mut rpowe = r.modpow(key.e(), key.n()); // N != 0
-        let mut c = c * &rpowe;
-        c %= key.n();
-
+        let r = reduce(&r, n_params.clone());
+        let mut rpowe = r.pow(key.e()).retrieve();
+        let c = mul_mod_params(c, &rpowe, n_params.clone());
         rpowe.zeroize();
 
         c
@@ -191,9 +216,17 @@ fn blind<R: CryptoRngCore, K: PublicKeyParts>(
     (c, unblinder)
 }
 
+/// Computes `lhs.mul_mod(rhs, n)` with precomputed `n_param`.
+fn mul_mod_params(lhs: &BoxedUint, rhs: &BoxedUint, n_params: BoxedResidueParams) -> BoxedUint {
+    // TODO: nicer api in crypto-bigint?
+    let lhs = BoxedResidue::new(lhs, n_params.clone());
+    let rhs = BoxedResidue::new(rhs, n_params);
+    (lhs * rhs).retrieve()
+}
+
 /// Given an m and and unblinding factor, unblind the m.
-fn unblind(key: &impl PublicKeyParts, m: &BigUint, unblinder: &BigUint) -> BigUint {
-    (m * unblinder) % key.n()
+fn unblind(m: &BoxedUint, unblinder: &BoxedUint, n_params: BoxedResidueParams) -> BoxedUint {
+    mul_mod_params(m, unblinder, n_params)
 }
 
 /// The following (deterministic) algorithm also recovers the prime factors `p` and `q` of a modulus `n`, given the

src/encoding.rs

@@ -4,6 +4,7 @@
 //! `pkcs1` crate's traits for types which impl the `pkcs8` crate's traits.
 
 use crate::{
+    key::to_biguint,
     traits::{PrivateKeyParts, PublicKeyParts},
     BigUint, RsaPrivateKey, RsaPublicKey,
 };
@@ -72,10 +73,12 @@ impl EncodePrivateKey for RsaPrivateKey {
         let modulus = self.n().to_bytes_be();
         let public_exponent = self.e().to_bytes_be();
         let private_exponent = Zeroizing::new(self.d().to_bytes_be());
-        let prime1 = Zeroizing::new(self.primes[0].to_bytes_be());
-        let prime2 = Zeroizing::new(self.primes[1].to_bytes_be());
-        let exponent1 = Zeroizing::new((self.d() % (&self.primes[0] - 1u8)).to_bytes_be());
-        let exponent2 = Zeroizing::new((self.d() % (&self.primes[1] - 1u8)).to_bytes_be());
+        let prime1 = Zeroizing::new(to_biguint(&self.primes[0]).to_bytes_be());
+        let prime2 = Zeroizing::new(to_biguint(&self.primes[1]).to_bytes_be());
+        let exponent1 =
+            Zeroizing::new((self.d() % (&to_biguint(&self.primes[0]) - 1u8)).to_bytes_be());
+        let exponent2 =
+            Zeroizing::new((self.d() % (&to_biguint(&self.primes[1]) - 1u8)).to_bytes_be());
         let coefficient = Zeroizing::new(
             self.crt_coefficient()
                 .ok_or(pkcs1::Error::Crypto)?