/src/openssl30/providers/implementations/kem/rsa_kem.c

Source (jump to first uncovered line)
/*
 * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * RSA low level APIs are deprecated for public use, but still ok for
 * internal use.
 */
#include "internal/deprecated.h"
#include "internal/nelem.h"

#include <openssl/crypto.h>
#include <openssl/evp.h>
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/rsa.h>
#include <openssl/params.h>
#include <openssl/err.h>
#include "crypto/rsa.h"
#include <openssl/proverr.h>
#include "prov/provider_ctx.h"
#include "prov/implementations.h"
#include "prov/securitycheck.h"

static OSSL_FUNC_kem_newctx_fn rsakem_newctx;
static OSSL_FUNC_kem_encapsulate_init_fn rsakem_encapsulate_init;
static OSSL_FUNC_kem_encapsulate_fn rsakem_generate;
static OSSL_FUNC_kem_decapsulate_init_fn rsakem_decapsulate_init;
static OSSL_FUNC_kem_decapsulate_fn rsakem_recover;
static OSSL_FUNC_kem_freectx_fn rsakem_freectx;
static OSSL_FUNC_kem_dupctx_fn rsakem_dupctx;
static OSSL_FUNC_kem_get_ctx_params_fn rsakem_get_ctx_params;
static OSSL_FUNC_kem_gettable_ctx_params_fn rsakem_gettable_ctx_params;
static OSSL_FUNC_kem_set_ctx_params_fn rsakem_set_ctx_params;
static OSSL_FUNC_kem_settable_ctx_params_fn rsakem_settable_ctx_params;

/*
 * Only the KEM for RSASVE as defined in SP800-56b r2 is implemented
 * currently.
 */
#define KEM_OP_UNDEFINED   -1
#define KEM_OP_RSASVE       0

/*
 * What's passed as an actual key is defined by the KEYMGMT interface.
 * We happen to know that our KEYMGMT simply passes RSA structures, so
 * we use that here too.
 */
typedef struct {
    OSSL_LIB_CTX *libctx;
    RSA *rsa;
    int op;
} PROV_RSA_CTX;

static const OSSL_ITEM rsakem_opname_id_map[] = {
    { KEM_OP_RSASVE, OSSL_KEM_PARAM_OPERATION_RSASVE },
};

static int name2id(const char *name, const OSSL_ITEM *map, size_t sz)
{
    size_t i;

    if (name == NULL)
        return -1;

    for (i = 0; i < sz; ++i) {
        if (OPENSSL_strcasecmp(map[i].ptr, name) == 0)
            return map[i].id;
    }
    return -1;
}

static int rsakem_opname2id(const char *name)
{
    return name2id(name, rsakem_opname_id_map, OSSL_NELEM(rsakem_opname_id_map));
}

static void *rsakem_newctx(void *provctx)
{
    PROV_RSA_CTX *prsactx =  OPENSSL_zalloc(sizeof(PROV_RSA_CTX));

    if (prsactx == NULL)
        return NULL;
    prsactx->libctx = PROV_LIBCTX_OF(provctx);
    prsactx->op = KEM_OP_UNDEFINED;

    return prsactx;
}

static void rsakem_freectx(void *vprsactx)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    RSA_free(prsactx->rsa);
    OPENSSL_free(prsactx);
}

static void *rsakem_dupctx(void *vprsactx)
{
    PROV_RSA_CTX *srcctx = (PROV_RSA_CTX *)vprsactx;
    PROV_RSA_CTX *dstctx;

    dstctx = OPENSSL_zalloc(sizeof(*srcctx));
    if (dstctx == NULL)
        return NULL;

    *dstctx = *srcctx;
    if (dstctx->rsa != NULL && !RSA_up_ref(dstctx->rsa)) {
        OPENSSL_free(dstctx);
        return NULL;
    }
    return dstctx;
}

static int rsakem_init(void *vprsactx, void *vrsa,
                       const OSSL_PARAM params[], int operation)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    if (prsactx == NULL || vrsa == NULL)
        return 0;

    if (!ossl_rsa_check_key(prsactx->libctx, vrsa, operation))
        return 0;

    if (!RSA_up_ref(vrsa))
        return 0;
    RSA_free(prsactx->rsa);
    prsactx->rsa = vrsa;

    return rsakem_set_ctx_params(prsactx, params);
}

static int rsakem_encapsulate_init(void *vprsactx, void *vrsa,
                                   const OSSL_PARAM params[])
{
    return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_ENCAPSULATE);
}

static int rsakem_decapsulate_init(void *vprsactx, void *vrsa,
                                   const OSSL_PARAM params[])
{
    return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECAPSULATE);
}

static int rsakem_get_ctx_params(void *vprsactx, OSSL_PARAM *params)
{
    PROV_RSA_CTX *ctx = (PROV_RSA_CTX *)vprsactx;

    return ctx != NULL;
}

static const OSSL_PARAM known_gettable_rsakem_ctx_params[] = {
    OSSL_PARAM_END
};

static const OSSL_PARAM *rsakem_gettable_ctx_params(ossl_unused void *vprsactx,
                                                    ossl_unused void *provctx)
{
    return known_gettable_rsakem_ctx_params;
}

static int rsakem_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
    const OSSL_PARAM *p;
    int op;

    if (prsactx == NULL)
        return 0;
    if (params == NULL)
        return 1;


    p = OSSL_PARAM_locate_const(params, OSSL_KEM_PARAM_OPERATION);
    if (p != NULL) {
        if (p->data_type != OSSL_PARAM_UTF8_STRING)
            return 0;
        op = rsakem_opname2id(p->data);
        if (op < 0)
            return 0;
        prsactx->op = op;
    }
    return 1;
}

static const OSSL_PARAM known_settable_rsakem_ctx_params[] = {
    OSSL_PARAM_utf8_string(OSSL_KEM_PARAM_OPERATION, NULL, 0),
    OSSL_PARAM_END
};

static const OSSL_PARAM *rsakem_settable_ctx_params(ossl_unused void *vprsactx,
                                                    ossl_unused void *provctx)
{
    return known_settable_rsakem_ctx_params;
}

/*
 * NIST.SP.800-56Br2
 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
 *
 * Generate a random in the range 1 < z < (n – 1)
 */
static int rsasve_gen_rand_bytes(RSA *rsa_pub,
                                 unsigned char *out, int outlen)
{
    int ret = 0;
    BN_CTX *bnctx;
    BIGNUM *z, *nminus3;

    bnctx = BN_CTX_secure_new_ex(ossl_rsa_get0_libctx(rsa_pub));
    if (bnctx == NULL)
        return 0;

    /*
     * Generate a random in the range 1 < z < (n – 1).
     * Since BN_priv_rand_range_ex() returns a value in range 0 <= r < max
     * We can achieve this by adding 2.. but then we need to subtract 3 from
     * the upper bound i.e: 2 + (0 <= r < (n - 3))
     */
    BN_CTX_start(bnctx);
    nminus3 = BN_CTX_get(bnctx);
    z = BN_CTX_get(bnctx);
    ret = (z != NULL
           && (BN_copy(nminus3, RSA_get0_n(rsa_pub)) != NULL)
           && BN_sub_word(nminus3, 3)
           && BN_priv_rand_range_ex(z, nminus3, 0, bnctx)
           && BN_add_word(z, 2)
           && (BN_bn2binpad(z, out, outlen) == outlen));
    BN_CTX_end(bnctx);
    BN_CTX_free(bnctx);
    return ret;
}

/*
 * NIST.SP.800-56Br2
 * 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
 */
static int rsasve_generate(PROV_RSA_CTX *prsactx,
                           unsigned char *out, size_t *outlen,
                           unsigned char *secret, size_t *secretlen)
{
    int ret;
    size_t nlen;

    /* Step (1): nlen = Ceil(len(n)/8) */
    nlen = RSA_size(prsactx->rsa);

    if (out == NULL) {
        if (nlen == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
            return 0;
        }
        if (outlen == NULL && secretlen == NULL)
            return 0;
        if (outlen != NULL)
            *outlen = nlen;
        if (secretlen != NULL)
            *secretlen = nlen;
        return 1;
    }

    /*
     * If outlen is specified, then it must report the length
     * of the out buffer on input so that we can confirm
     * its size is sufficent for encapsulation
     */
    if (outlen != NULL && *outlen < nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
        return 0;
    }

    /*
     * Step (2): Generate a random byte string z of nlen bytes where
     *            1 < z < n - 1
     */
    if (!rsasve_gen_rand_bytes(prsactx->rsa, secret, nlen))
        return 0;

    /* Step(3): out = RSAEP((n,e), z) */
    ret = RSA_public_encrypt(nlen, secret, out, prsactx->rsa, RSA_NO_PADDING);
    if (ret) {
        ret = 1;
        if (outlen != NULL)
            *outlen = nlen;
        if (secretlen != NULL)
            *secretlen = nlen;
    } else {
        OPENSSL_cleanse(secret, nlen);
    }
    return ret;
}

/**
 * rsasve_recover - Recovers a secret value from ciphertext using an RSA
 * private key.  Once, recovered, the secret value is considered to be a
 * shared secret.  Algorithm is preformed as per
 * NIST SP 800-56B Rev 2
 * 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).
 *
 * This function performs RSA decryption using the private key from the
 * provided RSA context (`prsactx`). It takes the input ciphertext, decrypts
 * it, and writes the decrypted message to the output buffer.
 *
 * @prsactx:      The RSA context containing the private key.
 * @out:          The output buffer to store the decrypted message.
 * @outlen:       On input, the size of the output buffer. On successful
 *                completion, the actual length of the decrypted message.
 * @in:           The input buffer containing the ciphertext to be decrypted.
 * @inlen:        The length of the input ciphertext in bytes.
 *
 * Returns 1 on success, or 0 on error. In case of error, appropriate
 * error messages are raised using the ERR_raise function.
 */
static int rsasve_recover(PROV_RSA_CTX *prsactx,
                          unsigned char *out, size_t *outlen,
                          const unsigned char *in, size_t inlen)
{
    size_t nlen;
    int ret;

    /* Step (1): get the byte length of n */
    nlen = RSA_size(prsactx->rsa);

    if (out == NULL) {
        if (nlen == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
            return 0;
        }
        *outlen = nlen;
        return 1;
    }

    /*
     * Step (2): check the input ciphertext 'inlen' matches the nlen
     * and that outlen is at least nlen bytes
     */
    if (inlen != nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH);
        return 0;
    }

    /*
     * If outlen is specified, then it must report the length
     * of the out buffer, so that we can confirm that it is of
     * sufficient size to hold the output of decapsulation
     */
    if (outlen != NULL && *outlen < nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
        return 0;
    }

    /* Step (3): out = RSADP((n,d), in) */
    ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING);
    if (ret > 0 && outlen != NULL)
        *outlen = ret;
    return ret > 0;
}

static int rsakem_generate(void *vprsactx, unsigned char *out, size_t *outlen,
                           unsigned char *secret, size_t *secretlen)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    switch (prsactx->op) {
        case KEM_OP_RSASVE:
            return rsasve_generate(prsactx, out, outlen, secret, secretlen);
        default:
            return -2;
    }
}

static int rsakem_recover(void *vprsactx, unsigned char *out, size_t *outlen,
                          const unsigned char *in, size_t inlen)
{
    PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;

    switch (prsactx->op) {
        case KEM_OP_RSASVE:
            return rsasve_recover(prsactx, out, outlen, in, inlen);
        default:
            return -2;
    }
}

const OSSL_DISPATCH ossl_rsa_asym_kem_functions[] = {
    { OSSL_FUNC_KEM_NEWCTX, (void (*)(void))rsakem_newctx },
    { OSSL_FUNC_KEM_ENCAPSULATE_INIT,
      (void (*)(void))rsakem_encapsulate_init },
    { OSSL_FUNC_KEM_ENCAPSULATE, (void (*)(void))rsakem_generate },
    { OSSL_FUNC_KEM_DECAPSULATE_INIT,
      (void (*)(void))rsakem_decapsulate_init },
    { OSSL_FUNC_KEM_DECAPSULATE, (void (*)(void))rsakem_recover },
    { OSSL_FUNC_KEM_FREECTX, (void (*)(void))rsakem_freectx },
    { OSSL_FUNC_KEM_DUPCTX, (void (*)(void))rsakem_dupctx },
    { OSSL_FUNC_KEM_GET_CTX_PARAMS,
      (void (*)(void))rsakem_get_ctx_params },
    { OSSL_FUNC_KEM_GETTABLE_CTX_PARAMS,
      (void (*)(void))rsakem_gettable_ctx_params },
    { OSSL_FUNC_KEM_SET_CTX_PARAMS,
      (void (*)(void))rsakem_set_ctx_params },
    { OSSL_FUNC_KEM_SETTABLE_CTX_PARAMS,
      (void (*)(void))rsakem_settable_ctx_params },
    { 0, NULL }
};

Coverage Report

Created: 2025-06-13 06:58

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/*
11		* RSA low level APIs are deprecated for public use, but still ok for
12		* internal use.
13		*/
14		#include "internal/deprecated.h"
15		#include "internal/nelem.h"
16
17		#include <openssl/crypto.h>
18		#include <openssl/evp.h>
19		#include <openssl/core_dispatch.h>
20		#include <openssl/core_names.h>
21		#include <openssl/rsa.h>
22		#include <openssl/params.h>
23		#include <openssl/err.h>
24		#include "crypto/rsa.h"
25		#include <openssl/proverr.h>
26		#include "prov/provider_ctx.h"
27		#include "prov/implementations.h"
28		#include "prov/securitycheck.h"
29
30		static OSSL_FUNC_kem_newctx_fn rsakem_newctx;
31		static OSSL_FUNC_kem_encapsulate_init_fn rsakem_encapsulate_init;
32		static OSSL_FUNC_kem_encapsulate_fn rsakem_generate;
33		static OSSL_FUNC_kem_decapsulate_init_fn rsakem_decapsulate_init;
34		static OSSL_FUNC_kem_decapsulate_fn rsakem_recover;
35		static OSSL_FUNC_kem_freectx_fn rsakem_freectx;
36		static OSSL_FUNC_kem_dupctx_fn rsakem_dupctx;
37		static OSSL_FUNC_kem_get_ctx_params_fn rsakem_get_ctx_params;
38		static OSSL_FUNC_kem_gettable_ctx_params_fn rsakem_gettable_ctx_params;
39		static OSSL_FUNC_kem_set_ctx_params_fn rsakem_set_ctx_params;
40		static OSSL_FUNC_kem_settable_ctx_params_fn rsakem_settable_ctx_params;
41
42		/*
43		* Only the KEM for RSASVE as defined in SP800-56b r2 is implemented
44		* currently.
45		*/
46	0	#define KEM_OP_UNDEFINED -1
47	0	#define KEM_OP_RSASVE 0
48
49		/*
50		* What's passed as an actual key is defined by the KEYMGMT interface.
51		* We happen to know that our KEYMGMT simply passes RSA structures, so
52		* we use that here too.
53		*/
54		typedef struct {
55		OSSL_LIB_CTX *libctx;
56		RSA *rsa;
57		int op;
58		} PROV_RSA_CTX;
59
60		static const OSSL_ITEM rsakem_opname_id_map[] = {
61		{ KEM_OP_RSASVE, OSSL_KEM_PARAM_OPERATION_RSASVE },
62		};
63
64		static int name2id(const char name, const OSSL_ITEM map, size_t sz)
65	0	{
66	0	size_t i;
67
68	0	if (name == NULL)
69	0	return -1;
70
71	0	for (i = 0; i < sz; ++i) {
72	0	if (OPENSSL_strcasecmp(map[i].ptr, name) == 0)
73	0	return map[i].id;
74	0	}
75	0	return -1;
76	0	}
77
78		static int rsakem_opname2id(const char *name)
79	0	{
80	0	return name2id(name, rsakem_opname_id_map, OSSL_NELEM(rsakem_opname_id_map));
81	0	}
82
83		static void rsakem_newctx(void provctx)
84	0	{
85	0	PROV_RSA_CTX *prsactx = OPENSSL_zalloc(sizeof(PROV_RSA_CTX));
86
87	0	if (prsactx == NULL)
88	0	return NULL;
89	0	prsactx->libctx = PROV_LIBCTX_OF(provctx);
90	0	prsactx->op = KEM_OP_UNDEFINED;
91
92	0	return prsactx;
93	0	}
94
95		static void rsakem_freectx(void *vprsactx)
96	0	{
97	0	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
98
99	0	RSA_free(prsactx->rsa);
100	0	OPENSSL_free(prsactx);
101	0	}
102
103		static void rsakem_dupctx(void vprsactx)
104	0	{
105	0	PROV_RSA_CTX srcctx = (PROV_RSA_CTX )vprsactx;
106	0	PROV_RSA_CTX *dstctx;
107
108	0	dstctx = OPENSSL_zalloc(sizeof(*srcctx));
109	0	if (dstctx == NULL)
110	0	return NULL;
111
112	0	dstctx = srcctx;
113	0	if (dstctx->rsa != NULL && !RSA_up_ref(dstctx->rsa)) {
114	0	OPENSSL_free(dstctx);
115	0	return NULL;
116	0	}
117	0	return dstctx;
118	0	}
119
120		static int rsakem_init(void vprsactx, void vrsa,
121		const OSSL_PARAM params[], int operation)
122	0	{
123	0	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
124
125	0	if (prsactx == NULL \|\| vrsa == NULL)
126	0	return 0;
127
128	0	if (!ossl_rsa_check_key(prsactx->libctx, vrsa, operation))
129	0	return 0;
130
131	0	if (!RSA_up_ref(vrsa))
132	0	return 0;
133	0	RSA_free(prsactx->rsa);
134	0	prsactx->rsa = vrsa;
135
136	0	return rsakem_set_ctx_params(prsactx, params);
137	0	}
138
139		static int rsakem_encapsulate_init(void vprsactx, void vrsa,
140		const OSSL_PARAM params[])
141	0	{
142	0	return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_ENCAPSULATE);
143	0	}
144
145		static int rsakem_decapsulate_init(void vprsactx, void vrsa,
146		const OSSL_PARAM params[])
147	0	{
148	0	return rsakem_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECAPSULATE);
149	0	}
150
151		static int rsakem_get_ctx_params(void vprsactx, OSSL_PARAM params)
152	0	{
153	0	PROV_RSA_CTX ctx = (PROV_RSA_CTX )vprsactx;
154
155	0	return ctx != NULL;
156	0	}
157
158		static const OSSL_PARAM known_gettable_rsakem_ctx_params[] = {
159		OSSL_PARAM_END
160		};
161
162		static const OSSL_PARAM rsakem_gettable_ctx_params(ossl_unused void vprsactx,
163		ossl_unused void *provctx)
164	0	{
165	0	return known_gettable_rsakem_ctx_params;
166	0	}
167
168		static int rsakem_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
169	0	{
170	0	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
171	0	const OSSL_PARAM *p;
172	0	int op;
173
174	0	if (prsactx == NULL)
175	0	return 0;
176	0	if (params == NULL)
177	0	return 1;
178
179
180	0	p = OSSL_PARAM_locate_const(params, OSSL_KEM_PARAM_OPERATION);
181	0	if (p != NULL) {
182	0	if (p->data_type != OSSL_PARAM_UTF8_STRING)
183	0	return 0;
184	0	op = rsakem_opname2id(p->data);
185	0	if (op < 0)
186	0	return 0;
187	0	prsactx->op = op;
188	0	}
189	0	return 1;
190	0	}
191
192		static const OSSL_PARAM known_settable_rsakem_ctx_params[] = {
193		OSSL_PARAM_utf8_string(OSSL_KEM_PARAM_OPERATION, NULL, 0),
194		OSSL_PARAM_END
195		};
196
197		static const OSSL_PARAM rsakem_settable_ctx_params(ossl_unused void vprsactx,
198		ossl_unused void *provctx)
199	5	{
200	5	return known_settable_rsakem_ctx_params;
201	5	}
202
203		/*
204		* NIST.SP.800-56Br2
205		* 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
206		*
207		* Generate a random in the range 1 < z < (n – 1)
208		*/
209		static int rsasve_gen_rand_bytes(RSA *rsa_pub,
210		unsigned char *out, int outlen)
211	0	{
212	0	int ret = 0;
213	0	BN_CTX *bnctx;
214	0	BIGNUM z, nminus3;
215
216	0	bnctx = BN_CTX_secure_new_ex(ossl_rsa_get0_libctx(rsa_pub));
217	0	if (bnctx == NULL)
218	0	return 0;
219
220		/*
221		* Generate a random in the range 1 < z < (n – 1).
222		* Since BN_priv_rand_range_ex() returns a value in range 0 <= r < max
223		* We can achieve this by adding 2.. but then we need to subtract 3 from
224		* the upper bound i.e: 2 + (0 <= r < (n - 3))
225		*/
226	0	BN_CTX_start(bnctx);
227	0	nminus3 = BN_CTX_get(bnctx);
228	0	z = BN_CTX_get(bnctx);
229	0	ret = (z != NULL
230	0	&& (BN_copy(nminus3, RSA_get0_n(rsa_pub)) != NULL)
231	0	&& BN_sub_word(nminus3, 3)
232	0	&& BN_priv_rand_range_ex(z, nminus3, 0, bnctx)
233	0	&& BN_add_word(z, 2)
234	0	&& (BN_bn2binpad(z, out, outlen) == outlen));
235	0	BN_CTX_end(bnctx);
236	0	BN_CTX_free(bnctx);
237	0	return ret;
238	0	}
239
240		/*
241		* NIST.SP.800-56Br2
242		* 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
243		*/
244		static int rsasve_generate(PROV_RSA_CTX *prsactx,
245		unsigned char out, size_t outlen,
246		unsigned char secret, size_t secretlen)
247	0	{
248	0	int ret;
249	0	size_t nlen;
250
251		/* Step (1): nlen = Ceil(len(n)/8) */
252	0	nlen = RSA_size(prsactx->rsa);
253
254	0	if (out == NULL) {
255	0	if (nlen == 0) {
256	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
257	0	return 0;
258	0	}
259	0	if (outlen == NULL && secretlen == NULL)
260	0	return 0;
261	0	if (outlen != NULL)
262	0	*outlen = nlen;
263	0	if (secretlen != NULL)
264	0	*secretlen = nlen;
265	0	return 1;
266	0	}
267
268		/*
269		* If outlen is specified, then it must report the length
270		* of the out buffer on input so that we can confirm
271		* its size is sufficent for encapsulation
272		*/
273	0	if (outlen != NULL && *outlen < nlen) {
274	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
275	0	return 0;
276	0	}
277
278		/*
279		* Step (2): Generate a random byte string z of nlen bytes where
280		* 1 < z < n - 1
281		*/
282	0	if (!rsasve_gen_rand_bytes(prsactx->rsa, secret, nlen))
283	0	return 0;
284
285		/* Step(3): out = RSAEP((n,e), z) */
286	0	ret = RSA_public_encrypt(nlen, secret, out, prsactx->rsa, RSA_NO_PADDING);
287	0	if (ret) {
288	0	ret = 1;
289	0	if (outlen != NULL)
290	0	*outlen = nlen;
291	0	if (secretlen != NULL)
292	0	*secretlen = nlen;
293	0	} else {
294	0	OPENSSL_cleanse(secret, nlen);
295	0	}
296	0	return ret;
297	0	}
298
299		/**
300		* rsasve_recover - Recovers a secret value from ciphertext using an RSA
301		* private key. Once, recovered, the secret value is considered to be a
302		* shared secret. Algorithm is preformed as per
303		* NIST SP 800-56B Rev 2
304		* 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).
305		*
306		* This function performs RSA decryption using the private key from the
307		* provided RSA context (`prsactx`). It takes the input ciphertext, decrypts
308		* it, and writes the decrypted message to the output buffer.
309		*
310		* @prsactx: The RSA context containing the private key.
311		* @out: The output buffer to store the decrypted message.
312		* @outlen: On input, the size of the output buffer. On successful
313		* completion, the actual length of the decrypted message.
314		* @in: The input buffer containing the ciphertext to be decrypted.
315		* @inlen: The length of the input ciphertext in bytes.
316		*
317		* Returns 1 on success, or 0 on error. In case of error, appropriate
318		* error messages are raised using the ERR_raise function.
319		*/
320		static int rsasve_recover(PROV_RSA_CTX *prsactx,
321		unsigned char out, size_t outlen,
322		const unsigned char *in, size_t inlen)
323	0	{
324	0	size_t nlen;
325	0	int ret;
326
327		/* Step (1): get the byte length of n */
328	0	nlen = RSA_size(prsactx->rsa);
329
330	0	if (out == NULL) {
331	0	if (nlen == 0) {
332	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
333	0	return 0;
334	0	}
335	0	*outlen = nlen;
336	0	return 1;
337	0	}
338
339		/*
340		* Step (2): check the input ciphertext 'inlen' matches the nlen
341		* and that outlen is at least nlen bytes
342		*/
343	0	if (inlen != nlen) {
344	0	ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH);
345	0	return 0;
346	0	}
347
348		/*
349		* If outlen is specified, then it must report the length
350		* of the out buffer, so that we can confirm that it is of
351		* sufficient size to hold the output of decapsulation
352		*/
353	0	if (outlen != NULL && *outlen < nlen) {
354	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
355	0	return 0;
356	0	}
357
358		/* Step (3): out = RSADP((n,d), in) */
359	0	ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING);
360	0	if (ret > 0 && outlen != NULL)
361	0	*outlen = ret;
362	0	return ret > 0;
363	0	}
364
365		static int rsakem_generate(void vprsactx, unsigned char out, size_t *outlen,
366		unsigned char secret, size_t secretlen)
367	0	{
368	0	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
369
370	0	switch (prsactx->op) {
371	0	case KEM_OP_RSASVE:
372	0	return rsasve_generate(prsactx, out, outlen, secret, secretlen);
373	0	default:
374	0	return -2;
375	0	}
376	0	}
377
378		static int rsakem_recover(void vprsactx, unsigned char out, size_t *outlen,
379		const unsigned char *in, size_t inlen)
380	0	{
381	0	PROV_RSA_CTX prsactx = (PROV_RSA_CTX )vprsactx;
382
383	0	switch (prsactx->op) {
384	0	case KEM_OP_RSASVE:
385	0	return rsasve_recover(prsactx, out, outlen, in, inlen);
386	0	default:
387	0	return -2;
388	0	}
389	0	}
390
391		const OSSL_DISPATCH ossl_rsa_asym_kem_functions[] = {
392		{ OSSL_FUNC_KEM_NEWCTX, (void (*)(void))rsakem_newctx },
393		{ OSSL_FUNC_KEM_ENCAPSULATE_INIT,
394		(void (*)(void))rsakem_encapsulate_init },
395		{ OSSL_FUNC_KEM_ENCAPSULATE, (void (*)(void))rsakem_generate },
396		{ OSSL_FUNC_KEM_DECAPSULATE_INIT,
397		(void (*)(void))rsakem_decapsulate_init },
398		{ OSSL_FUNC_KEM_DECAPSULATE, (void (*)(void))rsakem_recover },
399		{ OSSL_FUNC_KEM_FREECTX, (void (*)(void))rsakem_freectx },
400		{ OSSL_FUNC_KEM_DUPCTX, (void (*)(void))rsakem_dupctx },
401		{ OSSL_FUNC_KEM_GET_CTX_PARAMS,
402		(void (*)(void))rsakem_get_ctx_params },
403		{ OSSL_FUNC_KEM_GETTABLE_CTX_PARAMS,
404		(void (*)(void))rsakem_gettable_ctx_params },
405		{ OSSL_FUNC_KEM_SET_CTX_PARAMS,
406		(void (*)(void))rsakem_set_ctx_params },
407		{ OSSL_FUNC_KEM_SETTABLE_CTX_PARAMS,
408		(void (*)(void))rsakem_settable_ctx_params },
409		{ 0, NULL }
410		};