rsa

nimony/lib/std/crypto/rsa.nim

RSA signature VERIFICATION (RFC 8017): PKCS #1 v1.5, which most certificate chains are signed with, and PSS, which TLS 1.3 demands for an RSA CertificateVerify.

Only the public operation lives here, so std/crypto/bignum's variable-time arithmetic is fine.

type RsaHash = enum
  rhSha256 = (0, "rhSha256")
  rhSha384 = (1, "rhSha384")
  rhSha512 = (2, "rhSha512")

func dollar`.RsaHash(e: RsaHash): string

type RsaPublicKey = object
  n: BigNum
  e: BigNum
  modBytes: int64

func digestLen(h: RsaHash): int64
func initRsaPublicKey(modulus: openArray[uint8]; exponent: openArray[uint8]; key: var RsaPublicKey): bool
From the big-endian integers of an RSAPublicKey. Refuses moduli below 2048 bits — anything smaller has not been safe to trust for years.
func rsaVerifyPkcs1v15(key: RsaPublicKey; h: RsaHash; message: openArray[uint8]; signature: openArray[uint8]): bool
RSASSA-PKCS1-v1_5. The expected encoding is BUILT and compared whole — parsing the decrypted block instead is how Bleichenbacher's 2006 forgery got through so many verifiers.
func rsaVerifyPss(key: RsaPublicKey; h: RsaHash; message: openArray[uint8]; signature: openArray[uint8]; saltLen: int64): bool
RSASSA-PSS with MGF1 over the same hash. TLS 1.3 fixes saltLen to the digest length; certificates say it in their algorithm parameters.