Struct Pka 

pub struct Pka<'d, M: Mode> { /* private fields */ }

Driver for the public key accelerator.

See the module documentation.

Implementations

impl<'d> Pka<'d, Blocking>

pub fn new_blocking(_peri: Peri<'d, CRYPTO_PKA>) -> Self

Creates a new blocking PKA driver.

impl<'d, M: Mode> Pka<'d, M>

pub fn blocking_mod_exp( &mut self, base: &[u8], exponent: &[u8], modulus: &[u8], output: &mut [u8], ) -> Result<(), Error>

Computes base ^ exponent mod modulus, the RSA primitive.

With the public exponent this is the RSA public key operation. With the private exponent it is the private key operation. For the latter, prefer Self::blocking_rsa_crt when the CRT parameters are available. It is about four times faster.

• The modulus must be odd.
• base and exponent must not be longer than the modulus.
• base must be smaller than the modulus.
• output must be as long as the modulus. The result is padded with zeros on the left.

This function does not apply or check any padding scheme. base must already be the encoded message or signature representative.

Errors: InvalidLength, InvalidModulus.

pub fn blocking_rsa_crt( &mut self, input: &[u8], p: &[u8], q: &[u8], dp: &[u8], dq: &[u8], qinv: &[u8], output: &mut [u8], ) -> Result<(), Error>

Computes the RSA private key operation using the Chinese remainder theorem.

• p, q: the prime factors of the modulus.
• dp, dq: the private exponent reduced modulo p - 1 and q - 1.
• qinv: the inverse of q modulo p.

All five must have the same length, half the modulus length. input and output must be as long as the modulus.

On the CryptoCell this operation is limited to a 2560-bit modulus, where Self::blocking_mod_exp still works up to 4096 bits.

Errors: InvalidLength, InvalidModulus.

pub fn blocking_ecc_mul( &mut self, curve: &Curve, scalar: &[u8], point: Point<'_>, output: PointMut<'_>, ) -> Result<(), Error>

Multiplies a curve point by a scalar, the ECDH primitive.

For ECDH, multiply the peer’s public key by your private key. The shared secret is the X coordinate of the result. Hash it before using it as a key.

• The point must be on the curve, which is checked: a point off the curve would leak the scalar through the result.
• The scalar must be nonzero and smaller than the curve order.

Errors: InvalidLength, InvalidScalar, InvalidPoint.

pub fn blocking_public_key( &mut self, curve: &Curve, private_key: &[u8], output: PointMut<'_>, ) -> Result<(), Error>

Derives the public key of a private key.

The private key must be nonzero and smaller than the curve order.

Errors: InvalidLength, InvalidScalar.

pub fn blocking_point_check( &mut self, curve: &Curve, point: Point<'_>, ) -> Result<(), Error>

Checks that a point is on the curve and is not the point at infinity.

Do this on every public key that comes from an untrusted source, before using it.

Errors: InvalidLength, InvalidPoint.

pub fn blocking_ecdsa_sign<RM: Mode>( &mut self, curve: &Curve, private_key: &[u8], hash: &[u8], rng: &mut Rng<'_, RM>, signature: SignatureMut<'_>, ) -> Result<(), Error>

Signs a hash with ECDSA.

• hash is the hash of the message. It may have any length. ECDSA uses its leftmost Curve::order_bits bits.
• The nonce is drawn from rng, uniformly in 1..n by rejection sampling, and never leaves the driver.

Errors: InvalidLength, InvalidScalar.

pub fn blocking_ecdsa_sign_with_nonce( &mut self, curve: &Curve, private_key: &[u8], k: &[u8], hash: &[u8], signature: SignatureMut<'_>, ) -> Result<(), Error>

Signs a hash with ECDSA and a caller-supplied nonce.

Prefer Self::blocking_ecdsa_sign, which draws the nonce itself. This is for deterministic signatures (RFC 6979) and known-answer tests.

• hash is the hash of the message. It may have any length. ECDSA uses its leftmost Curve::order_bits bits.
• k is the nonce. It must be uniformly random, nonzero and smaller than the curve order, fresh for every signature, and secret: signing two messages with the same k, or with a predictable or biased one, reveals the private key.

Errors: InvalidLength, InvalidScalar, and RetryWithNewK if k happens to produce an unusable signature. This is vanishingly unlikely. Draw a new k and sign again.

pub fn blocking_ecdsa_verify( &mut self, curve: &Curve, public_key: Point<'_>, signature: Signature<'_>, hash: &[u8], ) -> Result<(), Error>

Verifies an ECDSA signature over a hash.

• hash is the hash of the message. It may have any length. ECDSA uses its leftmost Curve::order_bits bits.
• The public key must be on the curve. This is not checked. Use Self::blocking_point_check on the first use of a key from an untrusted source.

Errors: InvalidLength, and InvalidSignature if the signature does not verify.