8#include <botan/internal/oaep.h>
10#include <botan/exceptn.h>
12#include <botan/internal/ct_utils.h>
13#include <botan/internal/mgf1.h>
14#include <botan/internal/stl_util.h>
24 RandomNumberGenerator& rng)
const {
28 throw Invalid_Argument(
"OAEP: Input is too large");
32 BufferStuffer stuffer(out);
35 rng.randomize(stuffer.next(m_Phash.size()));
36 stuffer.append(m_Phash);
37 stuffer.append(0x00, stuffer.remaining_capacity() - (1 + in_length));
39 stuffer.append({in, in_length});
42 mgf1_mask(*m_mgf1_hash, out.data(), m_Phash.size(), &out[m_Phash.size()], out.size() - m_Phash.size());
44 mgf1_mask(*m_mgf1_hash, &out[m_Phash.size()], out.size() - m_Phash.size(), out.data(), m_Phash.size());
77 const size_t hlen = m_Phash.size();
79 mgf1_mask(*m_mgf1_hash, &input[hlen], input.size() - hlen, input.data(), hlen);
81 mgf1_mask(*m_mgf1_hash, input.data(), hlen, &input[hlen], input.size() - hlen);
83 auto unpadded =
oaep_find_delim(valid_mask, input.data(), input.size(), m_Phash);
84 valid_mask &= leading_0.unpoisoned_value();
89 const uint8_t input[],
92 const size_t hlen = Phash.size();
95 if(input_len < 1 + 2 * hlen) {
101 size_t delim_idx = 2 * hlen;
105 for(
size_t i = delim_idx; i < input_len; ++i) {
109 const auto add_m = waiting_for_delim & zero_m;
111 bad_input_m |= waiting_for_delim & ~(zero_m | one_m);
113 delim_idx += add_m.if_set_return(1);
115 waiting_for_delim &= zero_m;
119 bad_input_m |= waiting_for_delim;
126 valid_mask = (~bad_input_m).unpoisoned_value();
127 auto output =
CT::copy_output(bad_input_m, input, input_len, delim_idx);
138 if(keybits / 8 > 2 * m_Phash.size() + 1) {
139 return ((keybits / 8) - 2 * m_Phash.size() - 1);
145OAEP::OAEP(std::unique_ptr<HashFunction> hash, std::string_view P) : m_mgf1_hash(std::move(hash)) {
146 m_Phash = m_mgf1_hash->process(P);
149OAEP::OAEP(std::unique_ptr<HashFunction> hash, std::unique_ptr<HashFunction> mgf1_hash, std::string_view P) :
150 m_mgf1_hash(std::move(mgf1_hash)) {
151 auto phash = std::move(hash);
152 m_Phash = phash->process(P);
#define BOTAN_ASSERT_NOMSG(expr)
static constexpr Mask< T > set()
static constexpr Mask< T > is_equal(T x, T y)
static constexpr Mask< T > is_zero(T x)
static constexpr Mask< T > cleared()
OAEP(std::unique_ptr< HashFunction > hash, std::string_view P="")
size_t maximum_input_size(size_t) const override
secure_vector< uint8_t > copy_output(CT::Mask< uint8_t > bad_input_u8, const uint8_t input[], size_t input_length, size_t offset)
constexpr CT::Mask< T > is_not_equal(const T x[], const T y[], size_t len)
constexpr void unpoison(const T *p, size_t n)
constexpr void poison(const T *p, size_t n)
void mgf1_mask(HashFunction &hash, const uint8_t in[], size_t in_len, uint8_t out[], size_t out_len)
secure_vector< uint8_t > oaep_find_delim(uint8_t &valid_mask, const uint8_t input[], size_t input_len, const secure_vector< uint8_t > &Phash)
std::vector< T, secure_allocator< T > > secure_vector