20 X509verify \- RSA encryption algorithm
28 .B #include <libsec.h>
31 .ta +\w'\fLPEMChain* 'u
32 RSApriv* rsagen(int nlen, int elen, int nrep)
35 RSApriv* rsafill(mpint *n, mpint *ek, mpint *dk, mpint *p, mpint *q)
38 mpint* rsaencrypt(RSApub *k, mpint *in, mpint *out)
41 mpint* rsadecrypt(RSApriv *k, mpint *in, mpint *out)
44 RSApub* rsapuballoc(void)
47 void rsapubfree(RSApub*)
50 RSApriv* rsaprivalloc(void)
53 void rsaprivfree(RSApriv*)
56 RSApub* rsaprivtopub(RSApriv*)
59 RSApub* X509toRSApub(uchar *cert, int ncert, char *name, int nname)
62 RSApriv* asn1toRSApriv(uchar *priv, int npriv)
65 void asn1dump(uchar *der, int len)
68 uchar* decodepem(char *s, char *type, int *len)
71 PEMChain* decodepemchain(char *s, char *type)
74 void X509dump(uchar *cert, int ncert)
77 uchar* X509gen(RSApriv *priv, char *subj, ulong valid[2], int *certlen);
80 uchar* X509req(RSApriv *priv, char *subj, int *certlen);
83 char* X509verify(uchar *cert, int ncert, RSApub *pk)
86 RSA is a public key encryption algorithm. The owner of a key publishes
87 the public part of the key:
92 mpint *ek; // exp (encryption key)
95 This part can be used for encrypting data (with
97 to be sent to the owner.
98 The owner decrypts (with
100 using his private key:
105 mpint *dk; // exp (decryption key)
107 // precomputed crt values
110 mpint *kp; // k mod p-1
111 mpint *kq; // k mod q-1
112 mpint *c2; // for converting residues to number
116 Keys are generated using
119 takes both bit length of the modulus, the bit length of the
120 public key exponent, and the number of repetitions of the Miller-Rabin
121 primality test to run. If the latter is 0, it does the default number
124 returns a newly allocated structure containing both
125 public and private keys.
127 returns a newly allocated copy of the public key
128 corresponding to the private key.
131 takes as input the bare minimum pieces of an RSA private key
132 and computes the rest
137 It returns a new private key.
141 even the ones that correspond directly to
144 are freshly allocated,
154 are provided to aid in user provided key I/O.
160 returns the public key and, if
162 is not nil, the CN part of the Distinguished Name of the
163 certificate's Subject.
164 (This is conventionally a userid or a host DNS name.)
165 No verification is done of the certificate signature; the
166 caller should check the fingerprint,
168 against a table or check the certificate by other means.
169 X.509 certificates are often stored in PEM format; use
171 to convert to binary before computing the fingerprint or calling
173 For the special case of
174 certificates signed by a known trusted key
175 (in a single step, without certificate chains)
177 checks the signature on
179 It returns nil if successful, else an error string.
182 prints an X.509 certificate to standard ouptut.
185 creates a self-signed X.509 certificate, given an RSA keypair
187 a issuer/subject string
189 and the starting and ending validity dates,
191 Length of the allocated binary certificate is stored in
193 The subject line is conventionally of the form
195 "C=US ST=NJ L=07922 O=Lucent OU='Bell Labs' CN=Eric"
197 using the quoting conventions of
203 creates an X.509 certification request.
206 converts an ASN1 formatted RSA private key into the corresponding
211 prints an ASN1 object to standard output.
214 takes a zero terminated string,
216 and decodes the PEM (privacy-enhanced mail) formatted section for
219 If successful, it returns the decoded section and sets
221 to its decoded length.
229 is similar but expects a sequence of PEM-formatted sections
230 and returns a linked list of the decodings:
233 typedef struct PEMChain PEMChain
