Source file src/crypto/rsa/rsa_test.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package rsa_test
     6  
     7  import (
     8  	"bufio"
     9  	"bytes"
    10  	"crypto"
    11  	"crypto/internal/boring"
    12  	"crypto/internal/cryptotest"
    13  	"crypto/internal/fips140"
    14  	"crypto/internal/fips140/ecdsa"
    15  	"crypto/rand"
    16  	. "crypto/rsa"
    17  	"crypto/sha1"
    18  	"crypto/sha256"
    19  	"crypto/sha512"
    20  	"crypto/x509"
    21  	"encoding/binary"
    22  	"encoding/hex"
    23  	"encoding/json"
    24  	"encoding/pem"
    25  	"flag"
    26  	"fmt"
    27  	"io"
    28  	"math/big"
    29  	"os"
    30  	"slices"
    31  	"strings"
    32  	"testing"
    33  )
    34  
    35  func TestKeyGeneration(t *testing.T) {
    36  	sizes := []int{128, 512, 1024, 2048, 3072, 4096}
    37  	if testing.Short() {
    38  		sizes = sizes[:2]
    39  	}
    40  	for _, size := range sizes {
    41  		t.Run(fmt.Sprintf("%d", size), func(t *testing.T) {
    42  			if size < 1024 {
    43  				_, err := GenerateKey(rand.Reader, size)
    44  				if err == nil {
    45  					t.Errorf("GenerateKey(%d) succeeded without GODEBUG", size)
    46  				}
    47  				t.Setenv("GODEBUG", "rsa1024min=0")
    48  			}
    49  			priv, err := GenerateKey(rand.Reader, size)
    50  			if err != nil {
    51  				t.Errorf("GenerateKey(%d): %v", size, err)
    52  			}
    53  			if bits := priv.N.BitLen(); bits != size {
    54  				t.Errorf("key too short (%d vs %d)", bits, size)
    55  			}
    56  			testKeyBasics(t, priv)
    57  		})
    58  	}
    59  }
    60  
    61  func Test3PrimeKeyGeneration(t *testing.T) {
    62  	size := 1024
    63  	if testing.Short() {
    64  		t.Setenv("GODEBUG", "rsa1024min=0")
    65  		size = 256
    66  	}
    67  
    68  	priv, err := GenerateMultiPrimeKey(rand.Reader, 3, size)
    69  	if err != nil {
    70  		t.Errorf("failed to generate key")
    71  	}
    72  	testKeyBasics(t, priv)
    73  }
    74  
    75  func Test4PrimeKeyGeneration(t *testing.T) {
    76  	size := 1024
    77  	if testing.Short() {
    78  		t.Setenv("GODEBUG", "rsa1024min=0")
    79  		size = 256
    80  	}
    81  
    82  	priv, err := GenerateMultiPrimeKey(rand.Reader, 4, size)
    83  	if err != nil {
    84  		t.Errorf("failed to generate key")
    85  	}
    86  	testKeyBasics(t, priv)
    87  }
    88  
    89  func TestNPrimeKeyGeneration(t *testing.T) {
    90  	t.Setenv("GODEBUG", "rsa1024min=0")
    91  	primeSize := 64
    92  	maxN := 24
    93  	if testing.Short() {
    94  		primeSize = 16
    95  		maxN = 16
    96  	}
    97  	// Test that generation of N-prime keys works for N > 4.
    98  	for n := 5; n < maxN; n++ {
    99  		priv, err := GenerateMultiPrimeKey(rand.Reader, n, 64+n*primeSize)
   100  		if err == nil {
   101  			testKeyBasics(t, priv)
   102  		} else {
   103  			t.Errorf("failed to generate %d-prime key", n)
   104  		}
   105  	}
   106  }
   107  
   108  func TestImpossibleKeyGeneration(t *testing.T) {
   109  	// This test ensures that trying to generate or validate toy RSA keys
   110  	// doesn't enter an infinite loop or panic.
   111  	t.Setenv("GODEBUG", "rsa1024min=0")
   112  	for i := 0; i < 32; i++ {
   113  		GenerateKey(rand.Reader, i)
   114  		GenerateMultiPrimeKey(rand.Reader, 3, i)
   115  		GenerateMultiPrimeKey(rand.Reader, 4, i)
   116  		GenerateMultiPrimeKey(rand.Reader, 5, i)
   117  	}
   118  }
   119  
   120  func TestTinyKeyGeneration(t *testing.T) {
   121  	// Toy-sized keys can randomly hit hard failures in GenerateKey.
   122  	if testing.Short() {
   123  		t.Skip("skipping in short mode")
   124  	}
   125  	t.Setenv("GODEBUG", "rsa1024min=0")
   126  	for range 10000 {
   127  		k, err := GenerateKey(rand.Reader, 32)
   128  		if err != nil {
   129  			t.Fatalf("GenerateKey(32): %v", err)
   130  		}
   131  		if err := k.Validate(); err != nil {
   132  			t.Fatalf("Validate(32): %v", err)
   133  		}
   134  	}
   135  }
   136  
   137  // TestKeyGenerationVectors tests RSA key generation against the
   138  // c2sp.org/det-keygen test vectors. See the comment on
   139  // [crypto/internal/fips140/rsa.GenerateKey] for more details.
   140  func TestKeyGenerationVectors(t *testing.T) {
   141  	// The RSA key generation algorithm changed after Go 1.26.0, so the
   142  	// generated keys only match with recent FIPS 140-3 modules.
   143  	cryptotest.MustMinimumFIPS140ModuleVersion(t, "v1.28.0")
   144  	var vectors []struct {
   145  		Bits  int
   146  		Seed  []byte
   147  		PKCS8 []byte `json:"private_key_pkcs8"`
   148  	}
   149  	f, err := os.Open("testdata/det-keygen.json")
   150  	if err != nil {
   151  		t.Fatalf("failed to open det-keygen.json: %v", err)
   152  	}
   153  	defer f.Close()
   154  	if err := json.NewDecoder(f).Decode(&vectors); err != nil {
   155  		t.Fatalf("failed to decode keygen.json: %v", err)
   156  	}
   157  	for i, v := range vectors {
   158  		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
   159  			t.Setenv("GODEBUG", "cryptocustomrand=1")
   160  			pers := []byte("det RSA key gen")
   161  			pers = binary.BigEndian.AppendUint16(pers, uint16(v.Bits))
   162  			drbg := ecdsa.TestingOnlyNewDRBG(sha256.New, v.Seed, nil, pers)
   163  			rng := &keyGenTestReader{next: func(p []byte) error {
   164  				drbg.Generate(p)
   165  				return nil
   166  			}}
   167  			priv, err := GenerateKey(rng, v.Bits)
   168  			if err != nil {
   169  				t.Fatalf("GenerateKey: %v", err)
   170  			}
   171  			testKeyBasics(t, priv)
   172  			der, err := x509.MarshalPKCS8PrivateKey(priv)
   173  			if err != nil {
   174  				t.Fatalf("MarshalPKCS8PrivateKey: %v", err)
   175  			}
   176  			if !bytes.Equal(der, v.PKCS8) {
   177  				t.Errorf("PKCS8 mismatch:\n%s\nvs\n\n%s", hex.Dump(der), hex.Dump(v.PKCS8))
   178  			}
   179  		})
   180  	}
   181  }
   182  
   183  type keyGenTestReader struct {
   184  	next func([]byte) error
   185  }
   186  
   187  func (r *keyGenTestReader) Read(p []byte) (n int, err error) {
   188  	// Neutralize randutil.MaybeReadByte.
   189  	//
   190  	// DO NOT COPY this. We *will* break you. We can do this because we're
   191  	// in the standard library, and can update this along with the
   192  	// GenerateKey implementation if necessary.
   193  	//
   194  	// You have been warned.
   195  	if len(p) == 1 {
   196  		return 1, nil
   197  	}
   198  
   199  	if err := r.next(p); err != nil {
   200  		return 0, err
   201  	}
   202  	return len(p), nil
   203  }
   204  
   205  func TestGnuTLSKey(t *testing.T) {
   206  	t.Setenv("GODEBUG", "rsa1024min=0")
   207  	// This is a key generated by `certtool --generate-privkey --bits 128`.
   208  	// It's such that de ≢ 1 mod φ(n), but is congruent mod the order of
   209  	// the group.
   210  	priv := parseKey(testingKey(`-----BEGIN RSA TESTING KEY-----
   211  MGECAQACEQDar8EuoZuSosYtE9SeXSyPAgMBAAECEBf7XDET8e6jjTcfO7y/sykC
   212  CQDozXjCjkBzLQIJAPB6MqNbZaQrAghbZTdQoko5LQIIUp9ZiKDdYjMCCCCpqzmX
   213  d8Y7
   214  -----END RSA TESTING KEY-----`))
   215  	testKeyBasics(t, priv)
   216  }
   217  
   218  func testKeyBasics(t *testing.T, priv *PrivateKey) {
   219  	defer func() {
   220  		if t.Failed() {
   221  			t.Logf("failed key: %#v", priv)
   222  		}
   223  	}()
   224  
   225  	if err := priv.Validate(); err != nil {
   226  		t.Errorf("Validate() failed: %s", err)
   227  	}
   228  	if priv.D.Cmp(priv.N) > 0 {
   229  		t.Errorf("private exponent too large")
   230  	}
   231  
   232  	msg := []byte("hi!")
   233  	enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
   234  	if err != nil {
   235  		t.Errorf("EncryptPKCS1v15: %v", err)
   236  		return
   237  	}
   238  
   239  	dec, err := DecryptPKCS1v15(nil, priv, enc)
   240  	if err != nil {
   241  		t.Errorf("DecryptPKCS1v15: %v", err)
   242  		return
   243  	}
   244  	if !bytes.Equal(dec, msg) {
   245  		t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
   246  	}
   247  }
   248  
   249  func TestAllocations(t *testing.T) {
   250  	cryptotest.SkipTestAllocations(t)
   251  
   252  	m := []byte("Hello Gophers")
   253  	c, err := EncryptPKCS1v15(rand.Reader, &test2048Key.PublicKey, m)
   254  	if err != nil {
   255  		t.Fatal(err)
   256  	}
   257  
   258  	if allocs := testing.AllocsPerRun(100, func() {
   259  		p, err := DecryptPKCS1v15(nil, test2048Key, c)
   260  		if err != nil {
   261  			t.Fatal(err)
   262  		}
   263  		if !bytes.Equal(p, m) {
   264  			t.Fatalf("unexpected output: %q", p)
   265  		}
   266  	}); allocs > 10 {
   267  		t.Errorf("expected less than 10 allocations, got %0.1f", allocs)
   268  	}
   269  }
   270  
   271  var allFlag = flag.Bool("all", false, "test all key sizes up to 2048")
   272  
   273  func TestEverything(t *testing.T) {
   274  	if testing.Short() {
   275  		// Skip key generation, but still test real sizes.
   276  		for _, key := range []*PrivateKey{test1024Key, test2048Key} {
   277  			t.Run(fmt.Sprintf("%d", key.N.BitLen()), func(t *testing.T) {
   278  				t.Parallel()
   279  				testEverything(t, key)
   280  			})
   281  		}
   282  		return
   283  	}
   284  
   285  	t.Setenv("GODEBUG", "rsa1024min=0")
   286  	min := 32
   287  	max := 560 // any smaller than this and not all tests will run
   288  	if *allFlag {
   289  		max = 2048
   290  	}
   291  	for size := min; size <= max; size++ {
   292  		t.Run(fmt.Sprintf("%d", size), func(t *testing.T) {
   293  			t.Parallel()
   294  			priv, err := GenerateKey(rand.Reader, size)
   295  			if err != nil {
   296  				t.Fatalf("GenerateKey(%d): %v", size, err)
   297  			}
   298  			if bits := priv.N.BitLen(); bits != size {
   299  				t.Errorf("key too short (%d vs %d)", bits, size)
   300  			}
   301  			testEverything(t, priv)
   302  		})
   303  	}
   304  }
   305  
   306  func testEverything(t *testing.T, priv *PrivateKey) {
   307  	validateErr := priv.Validate()
   308  	if validateErr != nil && len(priv.Primes) >= 2 {
   309  		t.Errorf("Validate() failed: %s", validateErr)
   310  	}
   311  
   312  	msg := []byte("test")
   313  	enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
   314  	if err == ErrMessageTooLong {
   315  		t.Log("key too small for EncryptPKCS1v15")
   316  	} else if err != nil {
   317  		t.Errorf("EncryptPKCS1v15: %v", err)
   318  	}
   319  	if err == nil {
   320  		dec, err := DecryptPKCS1v15(nil, priv, enc)
   321  		if err != nil {
   322  			t.Errorf("DecryptPKCS1v15: %v", err)
   323  		}
   324  		err = DecryptPKCS1v15SessionKey(nil, priv, enc, make([]byte, 4))
   325  		if err != nil {
   326  			t.Errorf("DecryptPKCS1v15SessionKey: %v", err)
   327  		}
   328  		if !bytes.Equal(dec, msg) {
   329  			t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
   330  		}
   331  	}
   332  
   333  	label := []byte("label")
   334  	enc, err = EncryptOAEP(sha256.New(), rand.Reader, &priv.PublicKey, msg, label)
   335  	if err == ErrMessageTooLong {
   336  		t.Log("key too small for EncryptOAEP")
   337  	} else if err != nil {
   338  		t.Errorf("EncryptOAEP: %v", err)
   339  	}
   340  	if err == nil {
   341  		dec, err := DecryptOAEP(sha256.New(), nil, priv, enc, label)
   342  		if err != nil {
   343  			t.Errorf("DecryptOAEP: %v", err)
   344  		}
   345  		if !bytes.Equal(dec, msg) {
   346  			t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
   347  		}
   348  	}
   349  
   350  	const hashMsg = "crypto/rsa: input must be hashed message"
   351  	sig, err := SignPKCS1v15(nil, priv, crypto.SHA256, msg)
   352  	if err == nil || err.Error() != hashMsg {
   353  		t.Errorf("SignPKCS1v15 with bad hash: err = %q, want %q", err, hashMsg)
   354  	}
   355  
   356  	hash := sha256.Sum256(msg)
   357  	sig, err = SignPKCS1v15(nil, priv, crypto.SHA256, hash[:])
   358  	if err == ErrMessageTooLong {
   359  		t.Log("key too small for SignPKCS1v15")
   360  	} else if err != nil {
   361  		t.Errorf("SignPKCS1v15: %v", err)
   362  	}
   363  	if err == nil {
   364  		err = VerifyPKCS1v15(&priv.PublicKey, crypto.SHA256, hash[:], sig)
   365  		if err != nil {
   366  			t.Errorf("VerifyPKCS1v15: %v", err)
   367  		}
   368  		sig[1] ^= 0x80
   369  		err = VerifyPKCS1v15(&priv.PublicKey, crypto.SHA256, hash[:], sig)
   370  		if err == nil {
   371  			t.Errorf("VerifyPKCS1v15 success for tampered signature")
   372  		}
   373  		sig[1] ^= 0x80
   374  		hash[1] ^= 0x80
   375  		err = VerifyPKCS1v15(&priv.PublicKey, crypto.SHA256, hash[:], sig)
   376  		if err == nil {
   377  			t.Errorf("VerifyPKCS1v15 success for tampered message")
   378  		}
   379  		hash[1] ^= 0x80
   380  	}
   381  
   382  	opts := &PSSOptions{SaltLength: PSSSaltLengthAuto}
   383  	sig, err = SignPSS(rand.Reader, priv, crypto.SHA256, hash[:], opts)
   384  	if err == ErrMessageTooLong {
   385  		t.Log("key too small for SignPSS with PSSSaltLengthAuto")
   386  	} else if err != nil {
   387  		t.Errorf("SignPSS: %v", err)
   388  	}
   389  	if err == nil {
   390  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   391  		if err != nil {
   392  			t.Errorf("VerifyPSS: %v", err)
   393  		}
   394  		sig[1] ^= 0x80
   395  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   396  		if err == nil {
   397  			t.Errorf("VerifyPSS success for tampered signature")
   398  		}
   399  		sig[1] ^= 0x80
   400  		hash[1] ^= 0x80
   401  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   402  		if err == nil {
   403  			t.Errorf("VerifyPSS success for tampered message")
   404  		}
   405  		hash[1] ^= 0x80
   406  	}
   407  
   408  	opts.SaltLength = PSSSaltLengthEqualsHash
   409  	sig, err = SignPSS(rand.Reader, priv, crypto.SHA256, hash[:], opts)
   410  	if err == ErrMessageTooLong {
   411  		t.Log("key too small for SignPSS with PSSSaltLengthEqualsHash")
   412  	} else if err != nil {
   413  		t.Errorf("SignPSS: %v", err)
   414  	}
   415  	if err == nil {
   416  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   417  		if err != nil {
   418  			t.Errorf("VerifyPSS: %v", err)
   419  		}
   420  		sig[1] ^= 0x80
   421  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   422  		if err == nil {
   423  			t.Errorf("VerifyPSS success for tampered signature")
   424  		}
   425  		sig[1] ^= 0x80
   426  		hash[1] ^= 0x80
   427  		err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], sig, opts)
   428  		if err == nil {
   429  			t.Errorf("VerifyPSS success for tampered message")
   430  		}
   431  		hash[1] ^= 0x80
   432  	}
   433  
   434  	// Check that an input bigger than the modulus is handled correctly,
   435  	// whether it is longer than the byte size of the modulus or not.
   436  	c := bytes.Repeat([]byte{0xff}, priv.Size())
   437  	err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], c, opts)
   438  	if err == nil {
   439  		t.Errorf("VerifyPSS accepted a large signature")
   440  	}
   441  	_, err = DecryptPKCS1v15(nil, priv, c)
   442  	if err == nil {
   443  		t.Errorf("DecryptPKCS1v15 accepted a large ciphertext")
   444  	}
   445  	c = append(c, 0xff)
   446  	err = VerifyPSS(&priv.PublicKey, crypto.SHA256, hash[:], c, opts)
   447  	if err == nil {
   448  		t.Errorf("VerifyPSS accepted a long signature")
   449  	}
   450  	_, err = DecryptPKCS1v15(nil, priv, c)
   451  	if err == nil {
   452  		t.Errorf("DecryptPKCS1v15 accepted a long ciphertext")
   453  	}
   454  
   455  	if validateErr == nil {
   456  		der, err := x509.MarshalPKCS8PrivateKey(priv)
   457  		if err != nil {
   458  			t.Errorf("MarshalPKCS8PrivateKey: %v", err)
   459  		}
   460  		key, err := x509.ParsePKCS8PrivateKey(der)
   461  		if err != nil {
   462  			t.Errorf("ParsePKCS8PrivateKey: %v", err)
   463  		}
   464  		if !key.(*PrivateKey).Equal(priv) {
   465  			t.Errorf("private key mismatch")
   466  		}
   467  	}
   468  
   469  	der, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
   470  	if err != nil {
   471  		t.Errorf("MarshalPKIXPublicKey: %v", err)
   472  	}
   473  	pub, err := x509.ParsePKIXPublicKey(der)
   474  	if err != nil {
   475  		t.Errorf("ParsePKIXPublicKey: %v", err)
   476  	}
   477  	if !pub.(*PublicKey).Equal(&priv.PublicKey) {
   478  		t.Errorf("public key mismatch")
   479  	}
   480  }
   481  
   482  func TestKeyTooSmall(t *testing.T) {
   483  	checkErr := func(err error) {
   484  		t.Helper()
   485  		if err == nil {
   486  			t.Error("expected error")
   487  		}
   488  		if !strings.Contains(err.Error(), "insecure") {
   489  			t.Errorf("unexpected error: %v", err)
   490  		}
   491  	}
   492  	checkErr2 := func(_ []byte, err error) {
   493  		t.Helper()
   494  		checkErr(err)
   495  	}
   496  
   497  	buf := make([]byte, 512/8)
   498  	checkErr2(test512Key.Sign(rand.Reader, buf, crypto.SHA512))
   499  	checkErr2(test512Key.Sign(rand.Reader, buf, &PSSOptions{SaltLength: PSSSaltLengthEqualsHash}))
   500  	checkErr2(test512Key.Decrypt(rand.Reader, buf, &PKCS1v15DecryptOptions{}))
   501  	checkErr2(test512Key.Decrypt(rand.Reader, buf, &OAEPOptions{Hash: crypto.SHA512}))
   502  	checkErr(VerifyPKCS1v15(&test512Key.PublicKey, crypto.SHA512, buf, buf))
   503  	checkErr(VerifyPSS(&test512Key.PublicKey, crypto.SHA512, buf, buf, &PSSOptions{SaltLength: PSSSaltLengthEqualsHash}))
   504  	checkErr2(SignPKCS1v15(rand.Reader, test512Key, crypto.SHA512, buf))
   505  	checkErr2(SignPSS(rand.Reader, test512Key, crypto.SHA512, buf, &PSSOptions{SaltLength: PSSSaltLengthEqualsHash}))
   506  	checkErr2(EncryptPKCS1v15(rand.Reader, &test512Key.PublicKey, buf))
   507  	checkErr2(EncryptOAEP(sha512.New(), rand.Reader, &test512Key.PublicKey, buf, nil))
   508  	checkErr2(DecryptPKCS1v15(nil, test512Key, buf))
   509  	checkErr2(DecryptOAEP(sha512.New(), nil, test512Key, buf, nil))
   510  	checkErr(DecryptPKCS1v15SessionKey(nil, test512Key, buf, buf))
   511  }
   512  
   513  func testingKey(s string) string { return strings.ReplaceAll(s, "TESTING KEY", "PRIVATE KEY") }
   514  
   515  func parseKey(s string) *PrivateKey {
   516  	p, _ := pem.Decode([]byte(s))
   517  	if p.Type == "PRIVATE KEY" {
   518  		k, err := x509.ParsePKCS8PrivateKey(p.Bytes)
   519  		if err != nil {
   520  			panic(err)
   521  		}
   522  		return k.(*PrivateKey)
   523  	}
   524  	k, err := x509.ParsePKCS1PrivateKey(p.Bytes)
   525  	if err != nil {
   526  		panic(err)
   527  	}
   528  	return k
   529  }
   530  
   531  var rsaPrivateKey = test1024Key
   532  
   533  var test512Key = parseKey(testingKey(`-----BEGIN RSA TESTING KEY-----
   534  MIIBOgIBAAJBALKZD0nEffqM1ACuak0bijtqE2QrI/KLADv7l3kK3ppMyCuLKoF0
   535  fd7Ai2KW5ToIwzFofvJcS/STa6HA5gQenRUCAwEAAQJBAIq9amn00aS0h/CrjXqu
   536  /ThglAXJmZhOMPVn4eiu7/ROixi9sex436MaVeMqSNf7Ex9a8fRNfWss7Sqd9eWu
   537  RTUCIQDasvGASLqmjeffBNLTXV2A5g4t+kLVCpsEIZAycV5GswIhANEPLmax0ME/
   538  EO+ZJ79TJKN5yiGBRsv5yvx5UiHxajEXAiAhAol5N4EUyq6I9w1rYdhPMGpLfk7A
   539  IU2snfRJ6Nq2CQIgFrPsWRCkV+gOYcajD17rEqmuLrdIRexpg8N1DOSXoJ8CIGlS
   540  tAboUGBxTDq3ZroNism3DaMIbKPyYrAqhKov1h5V
   541  -----END RSA TESTING KEY-----`))
   542  
   543  var test512KeyTwo = parseKey(testingKey(`-----BEGIN TESTING KEY-----
   544  MIIBVgIBADANBgkqhkiG9w0BAQEFAASCAUAwggE8AgEAAkEA0wLCoguSfgskR8tY
   545  Fh2AzXQzBpSEmPucxtVe93HzPdQpxvtSTvZe5kIsdvPc7QZ0dCc/qbnUBRbuGIAl
   546  Ir0c9QIDAQABAkAzul+AXhnhcFXKi9ziPwVOWIgRuuLupe//BluriXG53BEBSVrV
   547  Hr7qFqwnSLSLroMzqhZwoqyRgjsLYyGEHDGBAiEA8T0sDPuht3w2Qv61IAvBwjLH
   548  H4HXjRUEWYRn1XjHqAUCIQDf7BYlANRqFfvg1YK3VCM4YyK2mH1UivDi8wdPlJRk
   549  MQIhAMp5i2WCNeNpD6n/WkqBU6kJMXPSaPZy82mm5feYHgt5AiEAkg/QnhB9fjma
   550  1BzRqD4Uv0pDMXIkhooe+Rrn0OwtI3ECIQDP6nxML3JOjbAS7ydFBv176uVsMJib
   551  r4PZozCXKuuGNg==
   552  -----END PRIVATE KEY-----`))
   553  
   554  var test1024Key = parseKey(testingKey(`-----BEGIN RSA TESTING KEY-----
   555  MIICXQIBAAKBgQCw0YNSqI9T1VFvRsIOejZ9feiKz1SgGfbe9Xq5tEzt2yJCsbyg
   556  +xtcuCswNhdqY5A1ZN7G60HbL4/Hh/TlLhFJ4zNHVylz9mDDx3yp4IIcK2lb566d
   557  fTD0B5EQ9Iqub4twLUdLKQCBfyhmJJvsEqKxm4J4QWgI+Brh/Pm3d4piPwIDAQAB
   558  AoGASC6fj6TkLfMNdYHLQqG9kOlPfys4fstarpZD7X+fUBJ/H/7y5DzeZLGCYAIU
   559  +QeAHWv6TfZIQjReW7Qy00RFJdgwFlTFRCsKXhG5x+IB+jL0Grr08KbgPPDgy4Jm
   560  xirRHZVtU8lGbkiZX+omDIU28EHLNWL6rFEcTWao/tERspECQQDp2G5Nw0qYWn7H
   561  Wm9Up1zkUTnkUkCzhqtxHbeRvNmHGKE7ryGMJEk2RmgHVstQpsvuFY4lIUSZEjAc
   562  DUFJERhFAkEAwZH6O1ULORp8sHKDdidyleYcZU8L7y9Y3OXJYqELfddfBgFUZeVQ
   563  duRmJj7ryu0g0uurOTE+i8VnMg/ostxiswJBAOc64Dd8uLJWKa6uug+XPr91oi0n
   564  OFtM+xHrNK2jc+WmcSg3UJDnAI3uqMc5B+pERLq0Dc6hStehqHjUko3RnZECQEGZ
   565  eRYWciE+Cre5dzfZkomeXE0xBrhecV0bOq6EKWLSVE+yr6mAl05ThRK9DCfPSOpy
   566  F6rgN3QiyCA9J/1FluUCQQC5nX+PTU1FXx+6Ri2ZCi6EjEKMHr7gHcABhMinZYOt
   567  N59pra9UdVQw9jxCU9G7eMyb0jJkNACAuEwakX3gi27b
   568  -----END RSA TESTING KEY-----`))
   569  
   570  var test2048KeyPEM = testingKey(`-----BEGIN TESTING KEY-----
   571  MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNoyFUYeDuqw+k
   572  iyv47iBy/udbWmQdpbUZ8JobHv8uQrvL7sQN6l83teHgNJsXqtiLF3MC+K+XI6Dq
   573  hxUWfQwLip8WEnv7Jx/+53S8yp/CS4Jw86Q1bQHbZjFDpcoqSuwAxlegw18HNZCY
   574  fpipYnA1lYCm+MTjtgXJQbjA0dwUGCf4BDMqt+76Jk3XZF5975rftbkGoT9eu8Jt
   575  Xs5F5Xkwd8q3fkQz+fpLW4u9jrfFyQ61RRFkYrCjlhtGjYIzBHGgQM4n/sNXhiy5
   576  h0tA7Xa6NyYrN/OXe/Y1K8Rz/tzlvbMoxgZgtBuKo1N3m8ckFi7hUVK2eNv7GoAb
   577  teTTPrg/AgMBAAECggEAAnfsVpmsL3R0Bh4gXRpPeM63H6e1a8B8kyVwiO9o0cXX
   578  gKp9+P39izfB0Kt6lyCj/Wg+wOQT7rg5qy1yIw7fBHGmcjquxh3uN0s3YZ+Vcym6
   579  SAY5f0vh/OyJN9r3Uv8+Pc4jtb7So7QDzdWeZurssBmUB0avAMRdGNFGP5SyILcz
   580  l3Q59hTxQ4czRHKjZ06L1/sA+tFVbO1j39FN8nMOU/ovLF4lAmZTkQ6AP6n6XPHP
   581  B8Nq7jSYz6RDO200jzp6UsdrnjjkJRbzOxN/fn+ckCP+WYuq+y/d05ET9PdVa4qI
   582  Jyr80D9QgHmfztcecvYwoskGnkb2F4Tmp0WnAj/xVQKBgQD4TrMLyyHdbAr5hoSi
   583  p+r7qBQxnHxPe2FKO7aqagi4iPEHauEDgwPIcsOYota1ACiSs3BaESdJAClbqPYd
   584  HDI4c2DZ6opux6WYkSju+tVXYW6qarR3fzrP3fUCdz2c2NfruWOqq8YmjzAhTNPm
   585  YzvtzTdwheNYV0Vi71t1SfZmfQKBgQDUAgSUcrgXdGDnSbaNe6KwjY5oZWOQfZe2
   586  DUhqfN/JRFZj+EMfIIh6OQXnZqkp0FeRdfRAFl8Yz8ESHEs4j+TikLJEeOdfmYLS
   587  TWxlMPDTUGbUvSf4g358NJ8TlfYA7dYpSTNPXMRSLtsz1palmaDBTE/V2xKtTH6p
   588  VglRNRUKawKBgCPqBh2TkN9czC2RFkgMb4FcqycN0jEQ0F6TSnVVhtNiAzKmc8s1
   589  POvWJZJDIzjkv/mP+JUeXAdD/bdjNc26EU126rA6KzGgsMPjYv9FymusDPybGGUc
   590  Qt5j5RcpNgEkn/5ZPyAlXjCfjz+RxChTfAyGHRmqU9qoLMIFir3pJ7llAoGBAMNH
   591  sIxENwlzqyafoUUlEq/pU7kZWuJmrO2FwqRDraYoCiM/NCRhxRQ/ng6NY1gejepw
   592  abD2alXiV4alBSxubne6rFmhvA00y2mG40c6Ezmxn2ZpbX3dMQ6bMcPKp7QnXtLc
   593  mCSL4FGK02ImUNDsd0RVVFw51DRId4rmsuJYMK9NAoGAKlYdc4784ixTD2ZICIOC
   594  ZWPxPAyQUEA7EkuUhAX1bVNG6UJTYA8kmGcUCG4jPTgWzi00IyUUr8jK7efyU/zs
   595  qiJuVs1bia+flYIQpysMl1VzZh8gW1nkB4SVPm5l2wBvVJDIr9Mc6rueC/oVNkh2
   596  fLVGuFoTVIu2bF0cWAjNNMg=
   597  -----END TESTING KEY-----`)
   598  
   599  var test2048Key = parseKey(test2048KeyPEM)
   600  
   601  var test2048KeyOnlyD = &PrivateKey{
   602  	PublicKey: test2048Key.PublicKey,
   603  	D:         test2048Key.D,
   604  }
   605  
   606  var test2048KeyWithoutPrecomputed = &PrivateKey{
   607  	PublicKey: test2048Key.PublicKey,
   608  	D:         test2048Key.D,
   609  	Primes:    test2048Key.Primes,
   610  }
   611  
   612  // test2048KeyWithPrecomputed is different from test2048Key because it includes
   613  // only the public precomputed values, and not the fips140/rsa.PrivateKey.
   614  var test2048KeyWithPrecomputed = &PrivateKey{
   615  	PublicKey: test2048Key.PublicKey,
   616  	D:         test2048Key.D,
   617  	Primes:    test2048Key.Primes,
   618  	Precomputed: PrecomputedValues{
   619  		Dp:   test2048Key.Precomputed.Dp,
   620  		Dq:   test2048Key.Precomputed.Dq,
   621  		Qinv: test2048Key.Precomputed.Qinv,
   622  	},
   623  }
   624  
   625  var test3072Key = parseKey(testingKey(`-----BEGIN TESTING KEY-----
   626  MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDJrvevql7G07LM
   627  xQAwAA1Oo8qUAkWfmpgrpxIUZE1QTyMCDaspQJGBBR2+iStrzi2NnWvyBz3jJWFZ
   628  LepnsMUFSXj5Ez6bEt2x9YbLAAVGhI6USrGAKqRdJ77+F7yIVCJWcV4vtTyN86IO
   629  UaHObwCR8GX7MUwJiRxDUZtYxJcwTMHSs4OWxNnqc+A8yRKn85CsCx0X9I1DULq+
   630  5BL8gF3MUXvb2zYzIOGI1s3lXOo9tHVcRVB1eV7dZHDyYGxZ4Exj9eKhiOL52hE6
   631  ZPTWCCKbQnyBV3HYe+t8DscOG/IzaAzLrx1s6xnqKEe5lUQ03Ty9QN3tpqqLsC4b
   632  CUkdk6Ma43KXGkCmoPaGCkssSc9qOrwHrqoMkOnZDWOJ5mKHhINKWV/U7p54T7tx
   633  FWI3PFvvYevoPf7cQdJcChbIBvQ+LEuVZvmljhONUjIGKBaqBz5Sjv7Fd5BNnBGz
   634  8NwH6tYdT9kdTkCZdfrazbuhLxN0mhhXp2sePRV2KZsB7i7cUJMCAwEAAQKCAYAT
   635  fqunbxmehhu237tUaHTg1e6WHvVu54kaUxm+ydvlTY5N5ldV801Sl4AtXjdJwjy0
   636  qcj430qpTarawsLxMezhcB2BlKLNEjucC5EeHIrmAEMt7LMP90868prAweJHRTv/
   637  zLvfcwPURClf0Uk0L0Dyr7Y+hnXZ8scTb2x2M06FQdjMY+4Yy+oKgm05mEVgNv1p
   638  e+DcjhbSMRf+rVoeeSQCmhprATCnLDWmE1QEqIC7OoR2SPxC1rAHnhatfwo00nwz
   639  rciN5YSOqoGa1WMNv6ut0HJWZnu5nR1OuZpaf+zrxlthMxPwhhPq0211J4fZviTO
   640  WLnubXD3/G9TN1TszeFuO7Ty8HYYkTJ3RLRrTRrfwhOtOJ4tkuwSJol3QIs1asab
   641  wYabuqyTv4+6JeoMBSLnMoA8rXSW9ti4gvJ1h8xMqmMF6e91Z0Fn7fvP5MCn/t8H
   642  8cIPhYLOhdPH5JMqxozb/a1s+JKvRTLnAXxNjlmyXzNvC+3Ixp4q9O8dWJ8Gt+EC
   643  gcEA+12m6iMXU3tBw1cYDcs/Jc0hOVgMAMgtnWZ4+p8RSucO/74bq82kdyAOJxao
   644  spAcK03NnpRBDcYsSyuQrE6AXQYel1Gj98mMtOirwt2T9vH5fHT6oKsqEu03hYIB
   645  5cggeie4wqKAOb9tVdShJk7YBJUgIXnAcqqmkD4oeUGzUV0QseQtspEHUJSqBQ9n
   646  yR4DmyMECgLm47S9LwPMtgRh9ADLBaZeuIRdBEKCDPgNkdya/dLb8u8kE8Ox3T3R
   647  +r2hAoHBAM1m1ZNqP9bEa74jZkpMxDN+vUdN7rZcxcpHu1nyii8OzXEopB+jByFA
   648  lmMqnKt8z5DRD0dmHXzOggnKJGO2j63/XFaVmsaXcM2B8wlRCqwm4mBE/bYCEKJl
   649  xqkDveICzwb1paWSgmFkjc6DN2g1jUd3ptOORuU38onrSphPHFxgyNlNTcOcXvxb
   650  GW4R8iPinvpkY3shluWqRQTvai1+gNQlmKMdqXvreUjKqJFCOhoRUVG/MDv8IdP2
   651  tXq43+UZswKBwQDSErOzi74r25/bVAdbR9gvjF7O4OGvKZzNpd1HfvbhxXcIjuXr
   652  UEK5+AU777ju+ndATZahiD9R9qP/8pnHFxg6JiocxnMlW8EHVEhv4+SMBjA+Ljlj
   653  W4kfJjc3ka5qTjWuQVIs/8fv+yayC7DeJhhsxACFWY5Xhn0LoZcLt7fYMNIKCauT
   654  R5d4ZbYt4nEXaMkUt0/h2gkCloNhLmjAWatPU/ZYc3FH/f8K11Z+5jPZCihSJw4A
   655  2pEpH2yffNHnHuECgcEAmxIWEHNYuwYT6brEETgfsFjxAZI+tIMZ+HtrYJ8R4DEm
   656  vVXXguMMEPi4ESosmfNiqYyMInVfscgeuNFZ48YCd3Sg++V6so/G5ABFwjTi/9Fj
   657  exbbDLxGXrTD5PokMyu3rSNr6bLQqELIJK8/93bmsJwO4Q07TPaOL73p1U90s/GF
   658  8TjBivrVY2RLsKPv0VPYfmWoDV/wkneYH/+4g5xMGt4/fHZ6bEn8iQ4ncXM0dlW4
   659  tSTIf6D80RAjNwG4VzitAoHAA8GLh22w+Cx8RPsj6xdrUiVFE+nNMMgeY8Mdjsrq
   660  Fh4jJb+4zwSML9R6iJu/LH5B7Fre2Te8QrYP+k/jIHPYJtGesVt/WlAtpDCNsC3j
   661  8CBzxwL6zkN+46pph35jPKUSaQQ2r8euNMp/sirkYcP8PpbdtifXCjN08QQIKsqj
   662  17IGHe9jZX/EVnSshCkXOBHG31buV10k5GSkeKcoDrkpp25wQ6FjW9L3Q68y6Y8r
   663  8h02sdAMB9Yc2A4EgzOySWoD
   664  -----END TESTING KEY-----`))
   665  
   666  var test4096Key = parseKey(testingKey(`-----BEGIN TESTING KEY-----
   667  MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCmH55T2e8fdUaL
   668  iWVL2yI7d/wOu/sxI4nVGoiRMiSMlMZlOEZ4oJY6l2y9N/b8ftwoIpjYO8CBk5au
   669  x2Odgpuz+FJyHppvKakUIeAn4940zoNkRe/iptybIuH5tCBygjs0y1617TlR/c5+
   670  FF5YRkzsEJrGcLqXzj0hDyrwdplBOv1xz2oHYlvKWWcVMR/qgwoRuj65Ef262t/Q
   671  ELH3+fFLzIIstFTk2co2WaALquOsOB6xGOJSAAr8cIAWe+3MqWM8DOcgBuhABA42
   672  9IhbBBw0uqTXUv/TGi6tcF29H2buSxAx/Wm6h2PstLd6IJAbWHAa6oTz87H0S6XZ
   673  v42cYoFhHma1OJw4id1oOZMFDTPDbHxgUnr2puSU+Fpxrj9+FWwViKE4j0YatbG9
   674  cNVpx9xo4NdvOkejWUrqziRorMZTk/zWKz0AkGQzTN3PrX0yy61BoWfznH/NXZ+o
   675  j3PqVtkUs6schoIYvrUcdhTCrlLwGSHhU1VKNGAUlLbNrIYTQNgt2gqvjLEsn4/i
   676  PgS1IsuDHIc7nGjzvKcuR0UeYCDkmBQqKrdhGbdJ1BRohzLdm+woRpjrqmUCbMa5
   677  VWWldJen0YyAlxNILvXMD117azeduseM1sZeGA9L8MmE12auzNbKr371xzgANSXn
   678  jRuyrblAZKc10kYStrcEmJdfNlzYAwIDAQABAoICABdQBpsD0W/buFuqm2GKzgIE
   679  c4Xp0XVy5EvYnmOp4sEru6/GtvUErDBqwaLIMMv8TY8AU+y8beaBPLsoVg1rn8gg
   680  yAklzExfT0/49QkEDFHizUOMIP7wpbLLsWSmZ4tKRV7CT3c+ZDXiZVECML84lmDm
   681  b6H7feQB2EhEZaU7L4Sc76ZCEkIZBoKeCz5JF46EdyxHs7erE61eO9xqC1+eXsNh
   682  Xr9BS0yWV69K4o/gmnS3p2747AHP6brFWuRM3fFDsB5kPScccQlSyF/j7yK+r+qi
   683  arGg/y+z0+sZAr6gooQ8Wnh5dJXtnBNCxSDJYw/DWHAeiyvk/gsndo3ZONlCZZ9u
   684  bpwBYx3hA2wTa5GUQxFM0KlI7Ftr9Cescf2jN6Ia48C6FcQsepMzD3jaMkLir8Jk
   685  /YD/s5KPzNvwPAyLnf7x574JeWuuxTIPx6b/fHVtboDK6j6XQnzrN2Hy3ngvlEFo
   686  zuGYVvtrz5pJXWGVSjZWG1kc9iXCdHKpmFdPj7XhU0gugTzQ/e5uRIqdOqfNLI37
   687  fppSuWkWd5uaAg0Zuhd+2L4LG2GhVdfFa1UeHBe/ncFKz1km9Bmjvt04TpxlRnVG
   688  wHxJZKlxpxCZ3AuLNUMP/QazPXO8OIfGOCbwkgFiqRY32mKDUvmEADBBoYpk/wBv
   689  qV99g5gvYFC5Le4QLzOJAoIBAQDcnqnK2tgkISJhsLs2Oj8vEcT7dU9vVnPSxTcC
   690  M0F+8ITukn33K0biUlA+ktcQaF+eeLjfbjkn/H0f2Ajn++ldT56MgAFutZkYvwxJ
   691  2A6PVB3jesauSpe8aqoKMDIj8HSA3+AwH+yU+yA9r5EdUq1S6PscP+5Wj22+thAa
   692  l65CFD77C0RX0lly5zdjQo3Vyca2HYGm/cshFCPRZc66TPjNAHFthbqktKjMQ91H
   693  Hg+Gun2zv8KqeSzMDeHnef4rVaWMIyIBzpu3QdkKPUXMQQxvJ+RW7+MORV9VjE7Z
   694  KVnHa/6x9n+jvtQ0ydHc2n0NOp6BQghTCB2G3w3JJfmPcRSNAoIBAQDAw6mPddoz
   695  UUzANMOYcFtos4EaWfTQE2okSLVAmLY2gtAK6ldTv6X9xl0IiC/DmWqiNZJ/WmVI
   696  glkp6iZhxBSmqov0X9P0M+jdz7CRnbZDFhQWPxSPicurYuPKs52IC08HgIrwErzT
   697  /lh+qRXEqzT8rTdftywj5fE89w52NPHBsMS07VhFsJtU4aY2Yl8y1PHeumXU6h66
   698  yTvoCLLxJPiLIg9PgvbMF+RiYyomIg75gwfx4zWvIvWdXifQBC88fE7lP2u5gtWL
   699  JUJaMy6LNKHn8YezvwQp0dRecvvoqzoApOuHfsPASHb9cfvcy/BxDXFMJO4QWCi1
   700  6WLaR835nKLPAoIBAFw7IHSjxNRl3b/FaJ6k/yEoZpdRVaIQHF+y/uo2j10IJCqw
   701  p2SbfQjErLNcI/jCCadwhKkzpUVoMs8LO73v/IF79aZ7JR4pYRWNWQ/N+VhGLDCb
   702  dVAL8x9b4DZeK7gGoE34SfsUfY1S5wmiyiHeHIOazs/ikjsxvwmJh3X2j20klafR
   703  8AJe9/InY2plunHz5tTfxQIQ+8iaaNbzntcXsrPRSZol2/9bX231uR4wHQGQGVj6
   704  A+HMwsOT0is5Pt7S8WCCl4b13vdf2eKD9xgK4a3emYEWzG985PwYqiXzOYs7RMEV
   705  cgr8ji57aPbRiJHtPbJ/7ob3z5BA07yR2aDz/0kCggEAZDyajHYNLAhHr98AIuGy
   706  NsS5CpnietzNoeaJEfkXL0tgoXxwQqVyzH7827XtmHnLgGP5NO4tosHdWbVflhEf
   707  Z/dhZYb7MY5YthcMyvvGziXJ9jOBHo7Z8Nowd7Rk41x2EQGfve0QcfBd1idYoXch
   708  y47LL6OReW1Vv4z84Szw1fZ0o1yUPVDzxPS9uKP4uvcOevJUh53isuB3nVYArvK5
   709  p6fjbEY+zaxS33KPdVrajJa9Z+Ptg4/bRqSycTHr2jkN0ZnkC4hkQMH0OfFJb6vD
   710  0VfAaBCZOqHZG/AQ3FFFjRY1P7UEV5WXAn3mKU+HTVJfKug9PxSIvueIttcF3Zm8
   711  8wKCAQAM43+DnGW1w34jpsTAeOXC5mhIz7J8spU6Uq5bJIheEE2AbX1z+eRVErZX
   712  1WsRNPsNrQfdt/b5IKboBbSYKoGxxRMngJI1eJqyj4LxZrACccS3euAlcU1q+3oN
   713  T10qfQol54KjGld/HVDhzbsZJxzLDqvPlroWgwLdOLDMXhwJYfTnqMEQkaG4Aawr
   714  3P14+Zp/woLiPWw3iZFcL/bt23IOa9YI0NoLhp5MFNXfIuzx2FhVz6BUSeVfQ6Ko
   715  Nx2YZ03g6Kt6B6c43LJx1a/zEPYSZcPERgWOSHlcjmwRfTs6uoN9xt1qs4zEUaKv
   716  Axreud3rJ0rekUp6rI1joG717Wls
   717  -----END TESTING KEY-----`))
   718  
   719  func BenchmarkDecryptPKCS1v15(b *testing.B) {
   720  	b.Run("2048", func(b *testing.B) { benchmarkDecryptPKCS1v15(b, test2048Key) })
   721  	b.Run("3072", func(b *testing.B) { benchmarkDecryptPKCS1v15(b, test3072Key) })
   722  	b.Run("4096", func(b *testing.B) { benchmarkDecryptPKCS1v15(b, test4096Key) })
   723  }
   724  
   725  func benchmarkDecryptPKCS1v15(b *testing.B, k *PrivateKey) {
   726  	r := bufio.NewReaderSize(rand.Reader, 1<<15)
   727  
   728  	m := []byte("Hello Gophers")
   729  	c, err := EncryptPKCS1v15(r, &k.PublicKey, m)
   730  	if err != nil {
   731  		b.Fatal(err)
   732  	}
   733  
   734  	b.ResetTimer()
   735  	var sink byte
   736  	for i := 0; i < b.N; i++ {
   737  		p, err := DecryptPKCS1v15(r, k, c)
   738  		if err != nil {
   739  			b.Fatal(err)
   740  		}
   741  		if !bytes.Equal(p, m) {
   742  			b.Fatalf("unexpected output: %q", p)
   743  		}
   744  		sink ^= p[0]
   745  	}
   746  }
   747  
   748  func BenchmarkEncryptPKCS1v15(b *testing.B) {
   749  	b.Run("2048", func(b *testing.B) {
   750  		r := bufio.NewReaderSize(rand.Reader, 1<<15)
   751  		m := []byte("Hello Gophers")
   752  
   753  		var sink byte
   754  		for i := 0; i < b.N; i++ {
   755  			c, err := EncryptPKCS1v15(r, &test2048Key.PublicKey, m)
   756  			if err != nil {
   757  				b.Fatal(err)
   758  			}
   759  			sink ^= c[0]
   760  		}
   761  	})
   762  }
   763  
   764  func BenchmarkDecryptOAEP(b *testing.B) {
   765  	b.Run("2048", func(b *testing.B) {
   766  		r := bufio.NewReaderSize(rand.Reader, 1<<15)
   767  
   768  		m := []byte("Hello Gophers")
   769  		c, err := EncryptOAEP(sha256.New(), r, &test2048Key.PublicKey, m, nil)
   770  		if err != nil {
   771  			b.Fatal(err)
   772  		}
   773  
   774  		b.ResetTimer()
   775  		var sink byte
   776  		for i := 0; i < b.N; i++ {
   777  			p, err := DecryptOAEP(sha256.New(), r, test2048Key, c, nil)
   778  			if err != nil {
   779  				b.Fatal(err)
   780  			}
   781  			if !bytes.Equal(p, m) {
   782  				b.Fatalf("unexpected output: %q", p)
   783  			}
   784  			sink ^= p[0]
   785  		}
   786  	})
   787  }
   788  
   789  func BenchmarkEncryptOAEP(b *testing.B) {
   790  	b.Run("2048", func(b *testing.B) {
   791  		r := bufio.NewReaderSize(rand.Reader, 1<<15)
   792  		m := []byte("Hello Gophers")
   793  
   794  		var sink byte
   795  		for i := 0; i < b.N; i++ {
   796  			c, err := EncryptOAEP(sha256.New(), r, &test2048Key.PublicKey, m, nil)
   797  			if err != nil {
   798  				b.Fatal(err)
   799  			}
   800  			sink ^= c[0]
   801  		}
   802  	})
   803  }
   804  
   805  func BenchmarkSignPKCS1v15(b *testing.B) {
   806  	b.Run("2048", func(b *testing.B) { benchmarkSignPKCS1v15(b, test2048Key) })
   807  	b.Run("2048/noprecomp/OnlyD", func(b *testing.B) {
   808  		benchmarkSignPKCS1v15(b, test2048KeyOnlyD)
   809  	})
   810  	b.Run("2048/noprecomp/Primes", func(b *testing.B) {
   811  		benchmarkSignPKCS1v15(b, test2048KeyWithoutPrecomputed)
   812  	})
   813  	// This is different from "2048" because it's only the public precomputed
   814  	// values, and not the crypto/internal/fips140/rsa.PrivateKey.
   815  	b.Run("2048/noprecomp/AllValues", func(b *testing.B) {
   816  		benchmarkSignPKCS1v15(b, test2048KeyWithPrecomputed)
   817  	})
   818  }
   819  
   820  func benchmarkSignPKCS1v15(b *testing.B, k *PrivateKey) {
   821  	hashed := sha256.Sum256([]byte("testing"))
   822  
   823  	var sink byte
   824  	b.ResetTimer()
   825  	for i := 0; i < b.N; i++ {
   826  		s, err := SignPKCS1v15(rand.Reader, k, crypto.SHA256, hashed[:])
   827  		if err != nil {
   828  			b.Fatal(err)
   829  		}
   830  		sink ^= s[0]
   831  	}
   832  }
   833  
   834  func BenchmarkVerifyPKCS1v15(b *testing.B) {
   835  	b.Run("2048", func(b *testing.B) {
   836  		hashed := sha256.Sum256([]byte("testing"))
   837  		s, err := SignPKCS1v15(rand.Reader, test2048Key, crypto.SHA256, hashed[:])
   838  		if err != nil {
   839  			b.Fatal(err)
   840  		}
   841  
   842  		b.ResetTimer()
   843  		for i := 0; i < b.N; i++ {
   844  			err := VerifyPKCS1v15(&test2048Key.PublicKey, crypto.SHA256, hashed[:], s)
   845  			if err != nil {
   846  				b.Fatal(err)
   847  			}
   848  		}
   849  	})
   850  }
   851  
   852  func BenchmarkSignPSS(b *testing.B) {
   853  	b.Run("2048", func(b *testing.B) {
   854  		hashed := sha256.Sum256([]byte("testing"))
   855  
   856  		var sink byte
   857  		b.ResetTimer()
   858  		for i := 0; i < b.N; i++ {
   859  			s, err := SignPSS(rand.Reader, test2048Key, crypto.SHA256, hashed[:], nil)
   860  			if err != nil {
   861  				b.Fatal(err)
   862  			}
   863  			sink ^= s[0]
   864  		}
   865  	})
   866  }
   867  
   868  func BenchmarkVerifyPSS(b *testing.B) {
   869  	b.Run("2048", func(b *testing.B) {
   870  		hashed := sha256.Sum256([]byte("testing"))
   871  		s, err := SignPSS(rand.Reader, test2048Key, crypto.SHA256, hashed[:], nil)
   872  		if err != nil {
   873  			b.Fatal(err)
   874  		}
   875  
   876  		b.ResetTimer()
   877  		for i := 0; i < b.N; i++ {
   878  			err := VerifyPSS(&test2048Key.PublicKey, crypto.SHA256, hashed[:], s, nil)
   879  			if err != nil {
   880  				b.Fatal(err)
   881  			}
   882  		}
   883  	})
   884  }
   885  
   886  func BenchmarkParsePKCS8PrivateKey(b *testing.B) {
   887  	b.Run("2048", func(b *testing.B) {
   888  		p, _ := pem.Decode([]byte(test2048KeyPEM))
   889  		b.ResetTimer()
   890  		for i := 0; i < b.N; i++ {
   891  			if _, err := x509.ParsePKCS8PrivateKey(p.Bytes); err != nil {
   892  				b.Fatal(err)
   893  			}
   894  		}
   895  	})
   896  }
   897  
   898  func BenchmarkGenerateKey(b *testing.B) {
   899  	// The RSA key generation algorithm changed after Go 1.26.0, so the testdata
   900  	// only accurately works with recent FIPS 140-3 modules.
   901  	cryptotest.MustMinimumFIPS140ModuleVersion(b, "v1.28.0")
   902  	b.Run("2048", func(b *testing.B) {
   903  		b.Setenv("GODEBUG", "cryptocustomrand=1")
   904  		primes, err := os.ReadFile("testdata/keygen2048.txt")
   905  		if err != nil {
   906  			b.Fatal(err)
   907  		}
   908  		for b.Loop() {
   909  			r := benchmarkPrimeReader(string(primes))
   910  			if _, err := GenerateKey(r, 2048); err != nil {
   911  				b.Fatal(err)
   912  			}
   913  		}
   914  	})
   915  	b.Run("3072", func(b *testing.B) {
   916  		b.Setenv("GODEBUG", "cryptocustomrand=1")
   917  		primes, err := os.ReadFile("testdata/keygen3072.txt")
   918  		if err != nil {
   919  			b.Fatal(err)
   920  		}
   921  		for b.Loop() {
   922  			r := benchmarkPrimeReader(string(primes))
   923  			if _, err := GenerateKey(r, 3072); err != nil {
   924  				b.Fatal(err)
   925  			}
   926  		}
   927  	})
   928  	b.Run("4096", func(b *testing.B) {
   929  		b.Setenv("GODEBUG", "cryptocustomrand=1")
   930  		primes, err := os.ReadFile("testdata/keygen4096.txt")
   931  		if err != nil {
   932  			b.Fatal(err)
   933  		}
   934  		for b.Loop() {
   935  			r := benchmarkPrimeReader(string(primes))
   936  			if _, err := GenerateKey(r, 4096); err != nil {
   937  				b.Fatal(err)
   938  			}
   939  		}
   940  	})
   941  }
   942  
   943  // benchmarkPrimeReader feeds prime candidates from a text file,
   944  // one per line in hex, to GenerateKey.
   945  func benchmarkPrimeReader(primes string) io.Reader {
   946  	return &keyGenTestReader{next: func(p []byte) error {
   947  		var line string
   948  		for line == "" || line[0] == '#' {
   949  			var ok bool
   950  			line, primes, ok = strings.Cut(primes, "\n")
   951  			if !ok {
   952  				return io.EOF
   953  			}
   954  		}
   955  		b, err := hex.DecodeString(line)
   956  		if err != nil {
   957  			return err
   958  		}
   959  		if len(p) != len(b) {
   960  			return fmt.Errorf("unexpected read length: %d", len(p))
   961  		}
   962  		copy(p, b)
   963  		return nil
   964  	}}
   965  }
   966  
   967  type testEncryptOAEPMessage struct {
   968  	in   []byte
   969  	seed []byte
   970  	out  []byte
   971  }
   972  
   973  type testEncryptOAEPStruct struct {
   974  	modulus string
   975  	e       int
   976  	d       string
   977  	msgs    []testEncryptOAEPMessage
   978  }
   979  
   980  func TestEncryptOAEP(t *testing.T) {
   981  	sha1 := sha1.New()
   982  	n := new(big.Int)
   983  	for i, test := range testEncryptOAEPData {
   984  		n.SetString(test.modulus, 16)
   985  		public := PublicKey{N: n, E: test.e}
   986  
   987  		for j, message := range test.msgs {
   988  			randomSource := bytes.NewReader(message.seed)
   989  			out, err := EncryptOAEP(sha1, randomSource, &public, message.in, nil)
   990  			if err != nil {
   991  				t.Errorf("#%d,%d error: %s", i, j, err)
   992  			}
   993  			if !bytes.Equal(out, message.out) {
   994  				t.Errorf("#%d,%d bad result: %x (want %x)", i, j, out, message.out)
   995  			}
   996  		}
   997  	}
   998  }
   999  
  1000  func TestDecryptOAEP(t *testing.T) {
  1001  	random := rand.Reader
  1002  
  1003  	sha1 := sha1.New()
  1004  	n := new(big.Int)
  1005  	d := new(big.Int)
  1006  	for i, test := range testEncryptOAEPData {
  1007  		n.SetString(test.modulus, 16)
  1008  		d.SetString(test.d, 16)
  1009  		private := new(PrivateKey)
  1010  		private.PublicKey = PublicKey{N: n, E: test.e}
  1011  		private.D = d
  1012  
  1013  		for j, message := range test.msgs {
  1014  			out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
  1015  			if err != nil {
  1016  				t.Errorf("#%d,%d error: %s", i, j, err)
  1017  			} else if !bytes.Equal(out, message.in) {
  1018  				t.Errorf("#%d,%d bad result: %#v (want %#v)", i, j, out, message.in)
  1019  			}
  1020  
  1021  			// Decrypt with blinding.
  1022  			out, err = DecryptOAEP(sha1, random, private, message.out, nil)
  1023  			if err != nil {
  1024  				t.Errorf("#%d,%d (blind) error: %s", i, j, err)
  1025  			} else if !bytes.Equal(out, message.in) {
  1026  				t.Errorf("#%d,%d (blind) bad result: %#v (want %#v)", i, j, out, message.in)
  1027  			}
  1028  		}
  1029  		if testing.Short() {
  1030  			break
  1031  		}
  1032  	}
  1033  }
  1034  
  1035  func Test2DecryptOAEP(t *testing.T) {
  1036  	random := rand.Reader
  1037  
  1038  	msg := []byte{0xed, 0x36, 0x90, 0x8d, 0xbe, 0xfc, 0x35, 0x40, 0x70, 0x4f, 0xf5, 0x9d, 0x6e, 0xc2, 0xeb, 0xf5, 0x27, 0xae, 0x65, 0xb0, 0x59, 0x29, 0x45, 0x25, 0x8c, 0xc1, 0x91, 0x22}
  1039  	in := []byte{0x72, 0x26, 0x84, 0xc9, 0xcf, 0xd6, 0xa8, 0x96, 0x04, 0x3e, 0x34, 0x07, 0x2c, 0x4f, 0xe6, 0x52, 0xbe, 0x46, 0x3c, 0xcf, 0x79, 0x21, 0x09, 0x64, 0xe7, 0x33, 0x66, 0x9b, 0xf8, 0x14, 0x22, 0x43, 0xfe, 0x8e, 0x52, 0x8b, 0xe0, 0x5f, 0x98, 0xef, 0x54, 0xac, 0x6b, 0xc6, 0x26, 0xac, 0x5b, 0x1b, 0x4b, 0x7d, 0x2e, 0xd7, 0x69, 0x28, 0x5a, 0x2f, 0x4a, 0x95, 0x89, 0x6c, 0xc7, 0x53, 0x95, 0xc7, 0xd2, 0x89, 0x04, 0x6f, 0x94, 0x74, 0x9b, 0x09, 0x0d, 0xf4, 0x61, 0x2e, 0xab, 0x48, 0x57, 0x4a, 0xbf, 0x95, 0xcb, 0xff, 0x15, 0xe2, 0xa0, 0x66, 0x58, 0xf7, 0x46, 0xf8, 0xc7, 0x0b, 0xb5, 0x1e, 0xa7, 0xba, 0x36, 0xce, 0xdd, 0x36, 0x41, 0x98, 0x6e, 0x10, 0xf9, 0x3b, 0x70, 0xbb, 0xa1, 0xda, 0x00, 0x40, 0xd5, 0xa5, 0x3f, 0x87, 0x64, 0x32, 0x7c, 0xbc, 0x50, 0x52, 0x0e, 0x4f, 0x21, 0xbd}
  1040  
  1041  	n := new(big.Int)
  1042  	d := new(big.Int)
  1043  	n.SetString(testEncryptOAEPData[0].modulus, 16)
  1044  	d.SetString(testEncryptOAEPData[0].d, 16)
  1045  	priv := new(PrivateKey)
  1046  	priv.PublicKey = PublicKey{N: n, E: testEncryptOAEPData[0].e}
  1047  	priv.D = d
  1048  	sha1 := crypto.SHA1
  1049  	sha256 := crypto.SHA256
  1050  
  1051  	out, err := priv.Decrypt(random, in, &OAEPOptions{MGFHash: sha1, Hash: sha256})
  1052  
  1053  	if err != nil {
  1054  		t.Errorf("error: %s", err)
  1055  	} else if !bytes.Equal(out, msg) {
  1056  		t.Errorf("bad result %#v (want %#v)", out, msg)
  1057  	}
  1058  }
  1059  
  1060  func TestEncryptDecryptOAEP(t *testing.T) {
  1061  	sha256 := sha256.New()
  1062  	n := new(big.Int)
  1063  	d := new(big.Int)
  1064  	for i, test := range testEncryptOAEPData {
  1065  		n.SetString(test.modulus, 16)
  1066  		d.SetString(test.d, 16)
  1067  		priv := new(PrivateKey)
  1068  		priv.PublicKey = PublicKey{N: n, E: test.e}
  1069  		priv.D = d
  1070  
  1071  		for j, message := range test.msgs {
  1072  			label := []byte(fmt.Sprintf("hi#%d", j))
  1073  			enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, message.in, label)
  1074  			if err != nil {
  1075  				t.Errorf("#%d,%d: EncryptOAEP: %v", i, j, err)
  1076  				continue
  1077  			}
  1078  			dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, label)
  1079  			if err != nil {
  1080  				t.Errorf("#%d,%d: DecryptOAEP: %v", i, j, err)
  1081  				continue
  1082  			}
  1083  			if !bytes.Equal(dec, message.in) {
  1084  				t.Errorf("#%d,%d: round trip %q -> %q", i, j, message.in, dec)
  1085  			}
  1086  
  1087  			// Using different hash for MGF.
  1088  			enc, err = EncryptOAEPWithOptions(rand.Reader, &priv.PublicKey, message.in, &OAEPOptions{Hash: crypto.SHA256, MGFHash: crypto.SHA1, Label: label})
  1089  			if err != nil {
  1090  				t.Errorf("#%d,%d: EncryptOAEP with different MGFHash: %v", i, j, err)
  1091  				continue
  1092  			}
  1093  			dec, err = priv.Decrypt(rand.Reader, enc, &OAEPOptions{Hash: crypto.SHA256, MGFHash: crypto.SHA1, Label: label})
  1094  			if err != nil {
  1095  				t.Errorf("#%d,%d: DecryptOAEP with different MGFHash: %v", i, j, err)
  1096  				continue
  1097  			}
  1098  			if !bytes.Equal(dec, message.in) {
  1099  				t.Errorf("#%d,%d: round trip with different MGFHash %q -> %q", i, j, message.in, dec)
  1100  			}
  1101  
  1102  			// Using a zero MGFHash.
  1103  			enc, err = EncryptOAEPWithOptions(rand.Reader, &priv.PublicKey, message.in, &OAEPOptions{Hash: crypto.SHA256, Label: label})
  1104  			if err != nil {
  1105  				t.Errorf("#%d,%d: EncryptOAEP with zero MGFHash: %v", i, j, err)
  1106  				continue
  1107  			}
  1108  			dec, err = DecryptOAEP(sha256, rand.Reader, priv, enc, label)
  1109  			if err != nil {
  1110  				t.Errorf("#%d,%d: DecryptOAEP with zero MGFHash: %v", i, j, err)
  1111  				continue
  1112  			}
  1113  			if !bytes.Equal(dec, message.in) {
  1114  				t.Errorf("#%d,%d: round trip with zero MGFHash %q -> %q", i, j, message.in, dec)
  1115  			}
  1116  		}
  1117  	}
  1118  }
  1119  
  1120  // testEncryptOAEPData contains a subset of the vectors from RSA's "Test vectors for RSA-OAEP".
  1121  var testEncryptOAEPData = []testEncryptOAEPStruct{
  1122  	// Key 1
  1123  	{"a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb",
  1124  		65537,
  1125  		"53339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1",
  1126  		[]testEncryptOAEPMessage{
  1127  			// Example 1.1
  1128  			{
  1129  				[]byte{0x66, 0x28, 0x19, 0x4e, 0x12, 0x07, 0x3d, 0xb0,
  1130  					0x3b, 0xa9, 0x4c, 0xda, 0x9e, 0xf9, 0x53, 0x23, 0x97,
  1131  					0xd5, 0x0d, 0xba, 0x79, 0xb9, 0x87, 0x00, 0x4a, 0xfe,
  1132  					0xfe, 0x34,
  1133  				},
  1134  				[]byte{0x18, 0xb7, 0x76, 0xea, 0x21, 0x06, 0x9d, 0x69,
  1135  					0x77, 0x6a, 0x33, 0xe9, 0x6b, 0xad, 0x48, 0xe1, 0xdd,
  1136  					0xa0, 0xa5, 0xef,
  1137  				},
  1138  				[]byte{0x35, 0x4f, 0xe6, 0x7b, 0x4a, 0x12, 0x6d, 0x5d,
  1139  					0x35, 0xfe, 0x36, 0xc7, 0x77, 0x79, 0x1a, 0x3f, 0x7b,
  1140  					0xa1, 0x3d, 0xef, 0x48, 0x4e, 0x2d, 0x39, 0x08, 0xaf,
  1141  					0xf7, 0x22, 0xfa, 0xd4, 0x68, 0xfb, 0x21, 0x69, 0x6d,
  1142  					0xe9, 0x5d, 0x0b, 0xe9, 0x11, 0xc2, 0xd3, 0x17, 0x4f,
  1143  					0x8a, 0xfc, 0xc2, 0x01, 0x03, 0x5f, 0x7b, 0x6d, 0x8e,
  1144  					0x69, 0x40, 0x2d, 0xe5, 0x45, 0x16, 0x18, 0xc2, 0x1a,
  1145  					0x53, 0x5f, 0xa9, 0xd7, 0xbf, 0xc5, 0xb8, 0xdd, 0x9f,
  1146  					0xc2, 0x43, 0xf8, 0xcf, 0x92, 0x7d, 0xb3, 0x13, 0x22,
  1147  					0xd6, 0xe8, 0x81, 0xea, 0xa9, 0x1a, 0x99, 0x61, 0x70,
  1148  					0xe6, 0x57, 0xa0, 0x5a, 0x26, 0x64, 0x26, 0xd9, 0x8c,
  1149  					0x88, 0x00, 0x3f, 0x84, 0x77, 0xc1, 0x22, 0x70, 0x94,
  1150  					0xa0, 0xd9, 0xfa, 0x1e, 0x8c, 0x40, 0x24, 0x30, 0x9c,
  1151  					0xe1, 0xec, 0xcc, 0xb5, 0x21, 0x00, 0x35, 0xd4, 0x7a,
  1152  					0xc7, 0x2e, 0x8a,
  1153  				},
  1154  			},
  1155  			// Example 1.2
  1156  			{
  1157  				[]byte{0x75, 0x0c, 0x40, 0x47, 0xf5, 0x47, 0xe8, 0xe4,
  1158  					0x14, 0x11, 0x85, 0x65, 0x23, 0x29, 0x8a, 0xc9, 0xba,
  1159  					0xe2, 0x45, 0xef, 0xaf, 0x13, 0x97, 0xfb, 0xe5, 0x6f,
  1160  					0x9d, 0xd5,
  1161  				},
  1162  				[]byte{0x0c, 0xc7, 0x42, 0xce, 0x4a, 0x9b, 0x7f, 0x32,
  1163  					0xf9, 0x51, 0xbc, 0xb2, 0x51, 0xef, 0xd9, 0x25, 0xfe,
  1164  					0x4f, 0xe3, 0x5f,
  1165  				},
  1166  				[]byte{0x64, 0x0d, 0xb1, 0xac, 0xc5, 0x8e, 0x05, 0x68,
  1167  					0xfe, 0x54, 0x07, 0xe5, 0xf9, 0xb7, 0x01, 0xdf, 0xf8,
  1168  					0xc3, 0xc9, 0x1e, 0x71, 0x6c, 0x53, 0x6f, 0xc7, 0xfc,
  1169  					0xec, 0x6c, 0xb5, 0xb7, 0x1c, 0x11, 0x65, 0x98, 0x8d,
  1170  					0x4a, 0x27, 0x9e, 0x15, 0x77, 0xd7, 0x30, 0xfc, 0x7a,
  1171  					0x29, 0x93, 0x2e, 0x3f, 0x00, 0xc8, 0x15, 0x15, 0x23,
  1172  					0x6d, 0x8d, 0x8e, 0x31, 0x01, 0x7a, 0x7a, 0x09, 0xdf,
  1173  					0x43, 0x52, 0xd9, 0x04, 0xcd, 0xeb, 0x79, 0xaa, 0x58,
  1174  					0x3a, 0xdc, 0xc3, 0x1e, 0xa6, 0x98, 0xa4, 0xc0, 0x52,
  1175  					0x83, 0xda, 0xba, 0x90, 0x89, 0xbe, 0x54, 0x91, 0xf6,
  1176  					0x7c, 0x1a, 0x4e, 0xe4, 0x8d, 0xc7, 0x4b, 0xbb, 0xe6,
  1177  					0x64, 0x3a, 0xef, 0x84, 0x66, 0x79, 0xb4, 0xcb, 0x39,
  1178  					0x5a, 0x35, 0x2d, 0x5e, 0xd1, 0x15, 0x91, 0x2d, 0xf6,
  1179  					0x96, 0xff, 0xe0, 0x70, 0x29, 0x32, 0x94, 0x6d, 0x71,
  1180  					0x49, 0x2b, 0x44,
  1181  				},
  1182  			},
  1183  			// Example 1.3
  1184  			{
  1185  				[]byte{0xd9, 0x4a, 0xe0, 0x83, 0x2e, 0x64, 0x45, 0xce,
  1186  					0x42, 0x33, 0x1c, 0xb0, 0x6d, 0x53, 0x1a, 0x82, 0xb1,
  1187  					0xdb, 0x4b, 0xaa, 0xd3, 0x0f, 0x74, 0x6d, 0xc9, 0x16,
  1188  					0xdf, 0x24, 0xd4, 0xe3, 0xc2, 0x45, 0x1f, 0xff, 0x59,
  1189  					0xa6, 0x42, 0x3e, 0xb0, 0xe1, 0xd0, 0x2d, 0x4f, 0xe6,
  1190  					0x46, 0xcf, 0x69, 0x9d, 0xfd, 0x81, 0x8c, 0x6e, 0x97,
  1191  					0xb0, 0x51,
  1192  				},
  1193  				[]byte{0x25, 0x14, 0xdf, 0x46, 0x95, 0x75, 0x5a, 0x67,
  1194  					0xb2, 0x88, 0xea, 0xf4, 0x90, 0x5c, 0x36, 0xee, 0xc6,
  1195  					0x6f, 0xd2, 0xfd,
  1196  				},
  1197  				[]byte{0x42, 0x37, 0x36, 0xed, 0x03, 0x5f, 0x60, 0x26,
  1198  					0xaf, 0x27, 0x6c, 0x35, 0xc0, 0xb3, 0x74, 0x1b, 0x36,
  1199  					0x5e, 0x5f, 0x76, 0xca, 0x09, 0x1b, 0x4e, 0x8c, 0x29,
  1200  					0xe2, 0xf0, 0xbe, 0xfe, 0xe6, 0x03, 0x59, 0x5a, 0xa8,
  1201  					0x32, 0x2d, 0x60, 0x2d, 0x2e, 0x62, 0x5e, 0x95, 0xeb,
  1202  					0x81, 0xb2, 0xf1, 0xc9, 0x72, 0x4e, 0x82, 0x2e, 0xca,
  1203  					0x76, 0xdb, 0x86, 0x18, 0xcf, 0x09, 0xc5, 0x34, 0x35,
  1204  					0x03, 0xa4, 0x36, 0x08, 0x35, 0xb5, 0x90, 0x3b, 0xc6,
  1205  					0x37, 0xe3, 0x87, 0x9f, 0xb0, 0x5e, 0x0e, 0xf3, 0x26,
  1206  					0x85, 0xd5, 0xae, 0xc5, 0x06, 0x7c, 0xd7, 0xcc, 0x96,
  1207  					0xfe, 0x4b, 0x26, 0x70, 0xb6, 0xea, 0xc3, 0x06, 0x6b,
  1208  					0x1f, 0xcf, 0x56, 0x86, 0xb6, 0x85, 0x89, 0xaa, 0xfb,
  1209  					0x7d, 0x62, 0x9b, 0x02, 0xd8, 0xf8, 0x62, 0x5c, 0xa3,
  1210  					0x83, 0x36, 0x24, 0xd4, 0x80, 0x0f, 0xb0, 0x81, 0xb1,
  1211  					0xcf, 0x94, 0xeb,
  1212  				},
  1213  			},
  1214  		},
  1215  	},
  1216  	// Key 10
  1217  	{"ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb",
  1218  		65537,
  1219  		"056b04216fe5f354ac77250a4b6b0c8525a85c59b0bd80c56450a22d5f438e596a333aa875e291dd43f48cb88b9d5fc0d499f9fcd1c397f9afc070cd9e398c8d19e61db7c7410a6b2675dfbf5d345b804d201add502d5ce2dfcb091ce9997bbebe57306f383e4d588103f036f7e85d1934d152a323e4a8db451d6f4a5b1b0f102cc150e02feee2b88dea4ad4c1baccb24d84072d14e1d24a6771f7408ee30564fb86d4393a34bcf0b788501d193303f13a2284b001f0f649eaf79328d4ac5c430ab4414920a9460ed1b7bc40ec653e876d09abc509ae45b525190116a0c26101848298509c1c3bf3a483e7274054e15e97075036e989f60932807b5257751e79",
  1220  		[]testEncryptOAEPMessage{
  1221  			// Example 10.1
  1222  			{
  1223  				[]byte{0x8b, 0xba, 0x6b, 0xf8, 0x2a, 0x6c, 0x0f, 0x86,
  1224  					0xd5, 0xf1, 0x75, 0x6e, 0x97, 0x95, 0x68, 0x70, 0xb0,
  1225  					0x89, 0x53, 0xb0, 0x6b, 0x4e, 0xb2, 0x05, 0xbc, 0x16,
  1226  					0x94, 0xee,
  1227  				},
  1228  				[]byte{0x47, 0xe1, 0xab, 0x71, 0x19, 0xfe, 0xe5, 0x6c,
  1229  					0x95, 0xee, 0x5e, 0xaa, 0xd8, 0x6f, 0x40, 0xd0, 0xaa,
  1230  					0x63, 0xbd, 0x33,
  1231  				},
  1232  				[]byte{0x53, 0xea, 0x5d, 0xc0, 0x8c, 0xd2, 0x60, 0xfb,
  1233  					0x3b, 0x85, 0x85, 0x67, 0x28, 0x7f, 0xa9, 0x15, 0x52,
  1234  					0xc3, 0x0b, 0x2f, 0xeb, 0xfb, 0xa2, 0x13, 0xf0, 0xae,
  1235  					0x87, 0x70, 0x2d, 0x06, 0x8d, 0x19, 0xba, 0xb0, 0x7f,
  1236  					0xe5, 0x74, 0x52, 0x3d, 0xfb, 0x42, 0x13, 0x9d, 0x68,
  1237  					0xc3, 0xc5, 0xaf, 0xee, 0xe0, 0xbf, 0xe4, 0xcb, 0x79,
  1238  					0x69, 0xcb, 0xf3, 0x82, 0xb8, 0x04, 0xd6, 0xe6, 0x13,
  1239  					0x96, 0x14, 0x4e, 0x2d, 0x0e, 0x60, 0x74, 0x1f, 0x89,
  1240  					0x93, 0xc3, 0x01, 0x4b, 0x58, 0xb9, 0xb1, 0x95, 0x7a,
  1241  					0x8b, 0xab, 0xcd, 0x23, 0xaf, 0x85, 0x4f, 0x4c, 0x35,
  1242  					0x6f, 0xb1, 0x66, 0x2a, 0xa7, 0x2b, 0xfc, 0xc7, 0xe5,
  1243  					0x86, 0x55, 0x9d, 0xc4, 0x28, 0x0d, 0x16, 0x0c, 0x12,
  1244  					0x67, 0x85, 0xa7, 0x23, 0xeb, 0xee, 0xbe, 0xff, 0x71,
  1245  					0xf1, 0x15, 0x94, 0x44, 0x0a, 0xae, 0xf8, 0x7d, 0x10,
  1246  					0x79, 0x3a, 0x87, 0x74, 0xa2, 0x39, 0xd4, 0xa0, 0x4c,
  1247  					0x87, 0xfe, 0x14, 0x67, 0xb9, 0xda, 0xf8, 0x52, 0x08,
  1248  					0xec, 0x6c, 0x72, 0x55, 0x79, 0x4a, 0x96, 0xcc, 0x29,
  1249  					0x14, 0x2f, 0x9a, 0x8b, 0xd4, 0x18, 0xe3, 0xc1, 0xfd,
  1250  					0x67, 0x34, 0x4b, 0x0c, 0xd0, 0x82, 0x9d, 0xf3, 0xb2,
  1251  					0xbe, 0xc6, 0x02, 0x53, 0x19, 0x62, 0x93, 0xc6, 0xb3,
  1252  					0x4d, 0x3f, 0x75, 0xd3, 0x2f, 0x21, 0x3d, 0xd4, 0x5c,
  1253  					0x62, 0x73, 0xd5, 0x05, 0xad, 0xf4, 0xcc, 0xed, 0x10,
  1254  					0x57, 0xcb, 0x75, 0x8f, 0xc2, 0x6a, 0xee, 0xfa, 0x44,
  1255  					0x12, 0x55, 0xed, 0x4e, 0x64, 0xc1, 0x99, 0xee, 0x07,
  1256  					0x5e, 0x7f, 0x16, 0x64, 0x61, 0x82, 0xfd, 0xb4, 0x64,
  1257  					0x73, 0x9b, 0x68, 0xab, 0x5d, 0xaf, 0xf0, 0xe6, 0x3e,
  1258  					0x95, 0x52, 0x01, 0x68, 0x24, 0xf0, 0x54, 0xbf, 0x4d,
  1259  					0x3c, 0x8c, 0x90, 0xa9, 0x7b, 0xb6, 0xb6, 0x55, 0x32,
  1260  					0x84, 0xeb, 0x42, 0x9f, 0xcc,
  1261  				},
  1262  			},
  1263  		},
  1264  	},
  1265  }
  1266  
  1267  func TestPSmallerThanQ(t *testing.T) {
  1268  	// This key has a 256-bit P and a 257-bit Q.
  1269  	k := parseKey(testingKey(`-----BEGIN RSA TESTING KEY-----
  1270  MIIBOgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
  1271  KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
  1272  o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
  1273  TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
  1274  9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
  1275  v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
  1276  /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
  1277  -----END RSA TESTING KEY-----`))
  1278  	t.Setenv("GODEBUG", "rsa1024min=0")
  1279  	if boring.Enabled {
  1280  		t.Skip("BoringCrypto mode returns the wrong error from SignPSS")
  1281  	}
  1282  	testEverything(t, k)
  1283  }
  1284  
  1285  func TestLargeSizeDifference(t *testing.T) {
  1286  	// This key has a 768-bit P and a 256-bit Q.
  1287  	k1 := parseKey(testingKey(`-----BEGIN TESTING KEY-----
  1288  MIICmAIBADANBgkqhkiG9w0BAQEFAASCAoIwggJ+AgEAAoGBAOB/V7qbbMLHZSHS
  1289  rU3FLNQJe88wQr5asy813wqlWsCeYUn7Imxv23vDXthpkH/54+CplWDvVri24zhU
  1290  4tHfONSEBWWKTRfQKCW+vrzf+d02rB95lVBrBDSKAUR6w1Xcx9/6ib+kQRDnMl2l
  1291  WZzDgv8jrNPrLGipYBOLcI9/Oh3HAgMBAAECgYBr85AiAX8JIoy0+POxA/GMfIr2
  1292  lERj+IVVXFhGbED5gjUBUn8kz/gOrClZAqgxJKVbdTcxn4KGOM64z427Y24H52zQ
  1293  sCq7RFJ9KDd4s1hAPQImBRUYu2blqDoqxNBQBxLHVUN7vwFp2MGsHzTz7mcx7QNG
  1294  teRbyLhCanUd3UOb4QJhAP5dyjIK1WzKBZ/jSAmjJL64bks4wEEl5eG6e2cTscCH
  1295  RE/OSpHi57dyrxgnBkczt56hOksJFzwmgk4wEM8n/JDOXwIzvAH4w4JWhu169gCW
  1296  8LgxCzJ71xv8+wUUouUTLwIhAOHwcdEAKyLo3K7X1nlYcUOX61yQ1GXRgIROGrsh
  1297  NNjpAmEAuW1nu4k4QmEXLpJB7nyWic3q4T0SsatN5HrMAL1To/U3sDHDHIxbvNiG
  1298  mcXBBuDFp4cC9rY+0OOFtDfH2SveKzW1/uX11T4iT/6Bx9cORCnEe5GNBxVOH6IQ
  1299  34hGo1WTAiEAyCYALW1AyUQPerOpQwWeEIrb7Lw/65KTjqDB/VOFRUECYQCPcc07
  1300  D19OB593kGklAtk1XwGt1W8OmfGIKhGMKzlYhb9MezjaX/3zpO19msSUmSNKszMX
  1301  RpZX4LYz9Ity0nxQ3qZYN6XYNwvr7dCV0E5eS+mgbGWRrf3utdbUkZUNwYE=
  1302  -----END TESTING KEY-----`))
  1303  
  1304  	// This key has a 256-bit P and a 768-bit Q.
  1305  	k2 := parseKey(testingKey(`-----BEGIN TESTING KEY-----
  1306  MIICVwIBADANBgkqhkiG9w0BAQEFAASCAkEwggI9AgEAAoGBAObSD1Q4cfUURAuY
  1307  RCCTDxv3TxK/VPJH/ees4eVkJHBkgErTXJsVb7df3Pyz8J5yVU7Y68osp1uRgJu1
  1308  E/v61L388oUQbpDlhpCzkpx2ZBfwx891JJBNgrRu/ZEDaWfXA4fx3iUDcA83NfY+
  1309  WWBlwwjhZG2jTQAgB0kz6fIhxODRAgMBAAECgYAJcO3i1WC25C5w1Xhy5yT68TuN
  1310  IiGWu+JbLa97NySE6tOHRvQk0QSTUGw8thsEoo3BAthlQtKHWLmvwPl1YNtEGE14
  1311  9gMlzoveiB10tMAJqmIaPoUWgQ2Wmzz+akYgr3zEloN+2ptVRYmboOWXGOHK4LJd
  1312  n5h7UvQNSqZyUvqogQIhAPOfMCgE3hvt4wA9cNUg3uQgUNnjr0ITiptNmgmoaaFB
  1313  AmEA8oxdQm/Uo1B5J2ebPj/e6mCi/wv3Ewq0CNE4Q1SiLmK1EKwyYj1pNBfrT2Vs
  1314  O5XsuFPC5V07iSjjfbaE8Q4zuKSmhVFe9aoAn8lwuuVBufGLFW7FD8PnhDZcqWsE
  1315  ksuRAiEA7sRa5y32Hbtlmquc9VV0/nJpq1NKRmFunE1PJh4IAMECYH0Q1ZHJWkqv
  1316  1xjzeoA5rPcLx2BdyhP+g+C8CRfmzw2+BgFH2V8ArXuYDdTNxmZfI0XUov1j+qv5
  1317  8nvDHn+xxAekltzNnXptI49A7qjgR+jaXM47ZM+BQ6LP6S3OqfgLkQIhAKbHdb9l
  1318  cHPGX1uUDRAU1xxtpVQ0OqXyEgqwz6y6hYRw
  1319  -----END TESTING KEY-----`))
  1320  
  1321  	if boring.Enabled {
  1322  		t.Skip("BoringCrypto mode returns the wrong error from SignPSS")
  1323  	}
  1324  	testEverything(t, k1)
  1325  	testEverything(t, k2)
  1326  }
  1327  
  1328  func TestNotPrecomputed(t *testing.T) {
  1329  	t.Run("OnlyD", func(t *testing.T) {
  1330  		testEverything(t, test2048KeyOnlyD)
  1331  		k := *test2048KeyOnlyD
  1332  		k.Precompute()
  1333  		testEverything(t, &k)
  1334  	})
  1335  	t.Run("Primes", func(t *testing.T) {
  1336  		testEverything(t, test2048KeyWithoutPrecomputed)
  1337  		k := *test2048KeyWithoutPrecomputed
  1338  		k.Precompute()
  1339  		if k.Precomputed.Dp == nil || k.Precomputed.Dq == nil || k.Precomputed.Qinv == nil {
  1340  			t.Error("Precomputed values should not be nil after Precompute()")
  1341  		}
  1342  		testEverything(t, &k)
  1343  	})
  1344  	t.Run("AllValues", func(t *testing.T) {
  1345  		testEverything(t, test2048KeyWithPrecomputed)
  1346  		k := *test2048KeyWithoutPrecomputed
  1347  		k.Precompute()
  1348  		if k.Precomputed.Dp == nil || k.Precomputed.Dq == nil || k.Precomputed.Qinv == nil {
  1349  			t.Error("Precomputed values should not be nil after Precompute()")
  1350  		}
  1351  		testEverything(t, &k)
  1352  	})
  1353  }
  1354  
  1355  func TestModifiedPrivateKey(t *testing.T) {
  1356  	if test512Key.Validate() != nil {
  1357  		t.Fatal("test512Key should be valid")
  1358  	}
  1359  
  1360  	t.Run("PublicKey mismatch", func(t *testing.T) {
  1361  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1362  			k.PublicKey = test512KeyTwo.PublicKey
  1363  		})
  1364  	})
  1365  	t.Run("Precomputed mismatch", func(t *testing.T) {
  1366  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1367  			k.Precomputed = test512KeyTwo.Precomputed
  1368  		})
  1369  	})
  1370  
  1371  	t.Run("D+2", func(t *testing.T) {
  1372  		if fips140.Version() == "v1.0.0" {
  1373  			t.Skip("This was fixed after v1.0.0")
  1374  		}
  1375  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1376  			k.D = new(big.Int).Add(k.D, big.NewInt(2))
  1377  		})
  1378  	})
  1379  	t.Run("D=0", func(t *testing.T) {
  1380  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1381  			k.D = new(big.Int)
  1382  		})
  1383  	})
  1384  	t.Run("D is nil", func(t *testing.T) {
  1385  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1386  			k.D = nil
  1387  		})
  1388  	})
  1389  
  1390  	t.Run("N+2", func(t *testing.T) {
  1391  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1392  			k.N = new(big.Int).Add(k.N, big.NewInt(2))
  1393  		})
  1394  	})
  1395  	t.Run("N=0", func(t *testing.T) {
  1396  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1397  			k.N = new(big.Int)
  1398  		})
  1399  	})
  1400  	t.Run("N is nil", func(t *testing.T) {
  1401  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1402  			k.N = nil
  1403  		})
  1404  	})
  1405  
  1406  	t.Run("P+2", func(t *testing.T) {
  1407  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1408  			k.Primes[0] = new(big.Int).Add(k.Primes[0], big.NewInt(2))
  1409  		})
  1410  	})
  1411  	t.Run("P=0", func(t *testing.T) {
  1412  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1413  			k.Primes[0] = new(big.Int)
  1414  		})
  1415  	})
  1416  	t.Run("P is nil", func(t *testing.T) {
  1417  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1418  			k.Primes[0] = nil
  1419  		})
  1420  	})
  1421  
  1422  	t.Run("Q+2", func(t *testing.T) {
  1423  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1424  			k.Primes[1] = new(big.Int).Add(k.Primes[1], big.NewInt(2))
  1425  		})
  1426  	})
  1427  	t.Run("Q=0", func(t *testing.T) {
  1428  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1429  			k.Primes[1] = new(big.Int)
  1430  		})
  1431  	})
  1432  	t.Run("Q is nil", func(t *testing.T) {
  1433  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1434  			k.Primes[1] = nil
  1435  		})
  1436  	})
  1437  
  1438  	t.Run("E+2", func(t *testing.T) {
  1439  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1440  			k.E += 2
  1441  		})
  1442  	})
  1443  	t.Run("E=0", func(t *testing.T) {
  1444  		testModifiedPrivateKey(t, func(k *PrivateKey) {
  1445  			k.E = 0
  1446  		})
  1447  	})
  1448  }
  1449  
  1450  func testModifiedPrivateKey(t *testing.T, f func(*PrivateKey)) {
  1451  	k := new(PrivateKey)
  1452  	*k = *test512Key
  1453  	k.Primes = slices.Clone(k.Primes)
  1454  	f(k)
  1455  	if err := k.Validate(); err == nil {
  1456  		t.Error("Validate should have failed")
  1457  	}
  1458  	k.Precompute()
  1459  	if err := k.Validate(); err == nil {
  1460  		t.Error("Validate should have failed after Precompute()")
  1461  	}
  1462  }
  1463  

View as plain text