RSA_padding_add_PKCS1_type_1(3) OpenSSL RSA_padding_add_PKCS1_type_1(3) NNAAMMEE RSA_padding_add_PKCS1_type_1, RSA_padding_check_PKCS1_type_1, RSA_pad- ding_add_PKCS1_type_2, RSA_padding_check_PKCS1_type_2, RSA_pad- ding_add_PKCS1_OAEP, RSA_padding_check_PKCS1_OAEP, RSA_pad- ding_add_SSLv23, RSA_padding_check_SSLv23, RSA_padding_add_none, RSA_padding_check_none - asymmetric encryption padding SSYYNNOOPPSSIISS #include int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen, unsigned char *f, int fl); int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen, unsigned char *f, int fl, int rsa_len); int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen, unsigned char *f, int fl); int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, unsigned char *f, int fl, int rsa_len); int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, unsigned char *f, int fl, unsigned char *p, int pl); int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, unsigned char *f, int fl, int rsa_len, unsigned char *p, int pl); int RSA_padding_add_SSLv23(unsigned char *to, int tlen, unsigned char *f, int fl); int RSA_padding_check_SSLv23(unsigned char *to, int tlen, unsigned char *f, int fl, int rsa_len); int RSA_padding_add_none(unsigned char *to, int tlen, unsigned char *f, int fl); int RSA_padding_check_none(unsigned char *to, int tlen, unsigned char *f, int fl, int rsa_len); DDEESSCCRRIIPPTTIIOONN The _R_S_A___p_a_d_d_i_n_g___x_x_x___x_x_x_(_) functions are called from the RSA encrypt, decrypt, sign and verify functions. Normally they should not be called from application programs. However, they can also be called directly to implement padding for other asymmetric ciphers. _R_S_A___p_a_d_d_i_n_g___a_d_d___P_K_C_S_1___O_A_E_P_(_) and _R_S_A___p_a_d_- _d_i_n_g___c_h_e_c_k___P_K_C_S_1___O_A_E_P_(_) may be used in an application combined with RRSSAA__NNOO__PPAADDDDIINNGG in order to implement OAEP with an encoding parameter. _R_S_A___p_a_d_d_i_n_g___a_d_d___x_x_x_(_) encodes ffll bytes from ff so as to fit into ttlleenn bytes and stores the result at ttoo. An error occurs if ffll does not meet the size requirements of the encoding method. The following encoding methods are implemented: PKCS1_type_1 PKCS #1 v2.0 EMSA-PKCS1-v1_5 (PKCS #1 v1.5 block type 1); used for signatures PKCS1_type_2 PKCS #1 v2.0 EME-PKCS1-v1_5 (PKCS #1 v1.5 block type 2) PKCS1_OAEP PKCS #1 v2.0 EME-OAEP SSLv23 PKCS #1 EME-PKCS1-v1_5 with SSL-specific modification none simply copy the data The random number generator must be seeded prior to calling _R_S_A___p_a_d_- _d_i_n_g___a_d_d___x_x_x_(_). _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___x_x_x_(_) verifies that the ffll bytes at ff contain a valid encoding for a rrssaa__lleenn byte RSA key in the respective encoding method and stores the recovered data of at most ttlleenn bytes (for RRSSAA__NNOO__PPAADD-- DDIINNGG: of size ttlleenn) at ttoo. For _R_S_A___p_a_d_d_i_n_g___x_x_x___O_A_E_P_(_), pp points to the encoding parameter of length ppll. pp may be NNUULLLL if ppll is 0. RREETTUURRNN VVAALLUUEESS The _R_S_A___p_a_d_d_i_n_g___a_d_d___x_x_x_(_) functions return 1 on success, 0 on error. The _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___x_x_x_(_) functions return the length of the recov- ered data, -1 on error. Error codes can be obtained by calling _E_R_R___g_e_t___e_r_r_o_r(3). WWAARRNNIINNGG The _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___P_K_C_S_1___t_y_p_e___2_(_) padding check leaks timing infor- mation which can potentially be used to mount a Bleichenbacher padding oracle attack. This is an inherent weakness in the PKCS #1 v1.5 padding design. Prefer PKCS1_OAEP padding. Otherwise it can be recommended to pass zero-padded ff, so that ffll equals to rrssaa__lleenn, and if fixed by pro- tocol, ttlleenn being set to the expected length. In such case leakage would be minimal, it would take attacker's ability to observe memory access pattern with byte granilarity as it occurs, post-factum timing analysis won't do. SSEEEE AALLSSOO _R_S_A___p_u_b_l_i_c___e_n_c_r_y_p_t(3), _R_S_A___p_r_i_v_a_t_e___d_e_c_r_y_p_t(3), _R_S_A___s_i_g_n(3), _R_S_A___v_e_r_- _i_f_y(3) HHIISSTTOORRYY _R_S_A___p_a_d_d_i_n_g___a_d_d___P_K_C_S_1___t_y_p_e___1_(_), _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___P_K_C_S_1___t_y_p_e___1_(_), _R_S_A___p_a_d_d_i_n_g___a_d_d___P_K_C_S_1___t_y_p_e___2_(_), _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___P_K_C_S_1___t_y_p_e___2_(_), _R_S_A___p_a_d_d_i_n_g___a_d_d___S_S_L_v_2_3_(_), _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___S_S_L_v_2_3_(_), _R_S_A___p_a_d_- _d_i_n_g___a_d_d___n_o_n_e_(_) and _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___n_o_n_e_(_) appeared in SSLeay 0.9.0. _R_S_A___p_a_d_d_i_n_g___a_d_d___P_K_C_S_1___O_A_E_P_(_) and _R_S_A___p_a_d_d_i_n_g___c_h_e_c_k___P_K_C_S_1___O_A_E_P_(_) were added in OpenSSL 0.9.2b. 1.0.2u 2019-12-20 RSA_padding_add_PKCS1_type_1(3)