Skip to content

Conversation

@sebastian-carpenter
Copy link
Contributor

@sebastian-carpenter sebastian-carpenter commented Dec 17, 2025

Adding tests for rsa key validation as well as adding some more cases to the rsa fromdata test.

Bugs:

  • WP segfaults when NULL is provided for param->data field (fixed)
  • General failure of rsa key validation (mostly fixed)
    • public key should have a few other tests
  • WP accepts any type of parameter value for rsa fields (fixed)
  • Storing param->data value: OSSL accepts negative values, so changed WP to accept negative values but store them as 0.

Additions (these are bugs too though):

  • Prime check in wp_rsa_validate against 133 primes.
  • The 'selection' variable used for rsa key importing was mostly unused, added section to make use of it.
    • This is to follow OSSL's implementation closer. Involved checking for D param, not just N and E.
  • No param may have more bits than the modulus.
  • Added checks that all CRT parameters are provided.
    • These checks vary between OSSL versions

Problems?

  • Should negative values be stored as 0? OSSL stores them as a negative and fails later but WP must store these values as unsigned.

}

if (ok) {
for(prime = 0; prime < VALIDATE_PRIMES_SIZE; prime++) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you not use mp_prime_is_prime() with 0 trials?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would fail before it tests primes because you can't have 0 trials (as far as I know).
OpenSSL does 5 rounds of miller-rabin anyway so I'd like to use mp_prime_is_prime() but I get different results between OpenSSL and wolfProvider.

@sebastian-carpenter sebastian-carpenter force-pushed the rsa-validate-tests branch 4 times, most recently from 3323f29 to 6dd7067 Compare January 9, 2026 22:12
updated rsa_key_import / validate to survive new tests
@sebastian-carpenter sebastian-carpenter marked this pull request as ready for review January 12, 2026 23:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants