Struct RsaPrivateKey

pub struct RsaPrivateKey { /* private fields */ }

RSA Private Key used in OpenTitan signing operations.

This is a wrapper for handling RSA priavate keys as they’re used in OpenTitan images.

Implementations

impl RsaPrivateKey

pub fn new() -> Result<Self>

Construct a new 3072-bit private key with e = 65537.

pub fn from_pkcs8_der_file<P: Into<PathBuf>>(der_file: P) -> Result<Self>

Construct a new private key from a PKCS8 encoded DER file.

pub fn to_pkcs8_der_file<P: Into<PathBuf>>(&self, der_file: P) -> Result<()>

Write private key to a PKCS8 encoded DER file.

pub fn sign(&self, digest: &Sha256Digest) -> Result<Signature>

Signs a SHA256 digest using PKCS1v15 padding scheme.

Methods from Deref<Target = RsaPrivateKey>

pub fn to_public_key(&self) -> RsaPublicKey

Get the public key from the private key, cloning n and e.

Generally this is not needed since RsaPrivateKey implements the PublicKey trait, but it can occasionally be useful to discard the private information entirely.

pub fn crt_coefficient(&self) -> Option<BigUint>

Compute CRT coefficient: (1/q) mod p.

pub fn validate(&self) -> Result<(), Error>

Performs basic sanity checks on the key. Returns Ok(()) if everything is good, otherwise an appropriate error.

pub fn decrypt<P>( &self, padding: P, ciphertext: &[u8], ) -> Result<Vec<u8>, Error>

where P: PaddingScheme,

Decrypt the given message.

pub fn decrypt_blinded<R, P>( &self, rng: &mut R, padding: P, ciphertext: &[u8], ) -> Result<Vec<u8>, Error>

where R: CryptoRngCore, P: PaddingScheme,

Decrypt the given message.

Uses rng to blind the decryption process.

pub fn sign<S>(&self, padding: S, digest_in: &[u8]) -> Result<Vec<u8>, Error>

where S: SignatureScheme,

Sign the given digest.

pub fn sign_with_rng<R, S>( &self, rng: &mut R, padding: S, digest_in: &[u8], ) -> Result<Vec<u8>, Error>

where R: CryptoRngCore, S: SignatureScheme,

Sign the given digest using the provided rng, which is used in the following ways depending on the [SignatureScheme]:

• [Pkcs1v15Sign][crate::Pkcs1v15Sign] padding: uses the RNG to mask the private key operation with random blinding, which helps mitigate sidechannel attacks.
• [Pss][crate::Pss] always requires randomness. Use [Pss::new][crate::Pss::new] for a standard RSASSA-PSS signature, or [Pss::new_blinded][crate::Pss::new_blinded] for RSA-BSSA blind signatures.

Trait Implementations

impl Clone for RsaPrivateKey

fn clone(&self) -> RsaPrivateKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RsaPrivateKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Deref for RsaPrivateKey

type Target = RsaPrivateKey

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.