rsa.c

Bug Summary

File:	s/lib/freebl/rsa.c
Warning:	line 1515, column 9 4th function call argument is an uninitialized value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name rsa.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/var/lib/jenkins/workspace/nss-scan-build/nss/lib/freebl -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/var/lib/jenkins/workspace/nss-scan-build/nss/lib/freebl -resource-dir /usr/lib/llvm-18/lib/clang/18 -D HAVE_STRERROR -D LINUX -D linux -D XP_UNIX -D XP_UNIX -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D SHLIB_SUFFIX="so" -D SHLIB_PREFIX="lib" -D SHLIB_VERSION="3" -D SOFTOKEN_SHLIB_VERSION="3" -D KYBER_K=3 -D RIJNDAEL_INCLUDE_TABLES -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D NSS_DISABLE_SSE3 -D NSS_NO_INIT_SUPPORT -D USE_UTIL_DIRECTLY -D NO_NSPR_10_SUPPORT -D SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -D NSS_USE_64 -D FREEBL_NO_DEPEND -D FREEBL_LOWHASH -D NSS_X86_OR_X64 -D NSS_X64 -D USE_HW_SHA2 -D NSS_BEVAND_ARCFOUR -D MPI_AMD64 -D MP_ASSEMBLY_MULTIPLY -D NSS_USE_COMBA -D MP_IS_LITTLE_ENDIAN -D USE_HW_AES -D INTEL_GCM -D HAVE_INT128_SUPPORT -D HACL_CAN_COMPILE_VEC256 -D MP_API_COMPATIBLE -I ../../../dist/Linux4.19_x86_64_gcc_glibc_PTH_64_DBG.OBJ/include -I ../../../dist/public/nss -I ../../../dist/private/nss -I mpi -I ecl -I verified -I verified/internal -I verified/karamel/include -I verified/karamel/krmllib/dist/minimal -I deprecated -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=c99 -ferror-limit 19 -fgnuc-version=4.2.1 -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2024-05-18-082241-28900-1 -x c rsa.c
1/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

5/*
* RSA key generation, public key op, private key op.
*/
8#ifdef FREEBL_NO_DEPEND1
9#include "stubs.h"
10#endif

12#include "secerr.h"

14#include "prclist.h"
15#include "nssilock.h"
16#include "prinit.h"
17#include "blapi.h"
18#include "mpi.h"
19#include "mpprime.h"
20#include "mplogic.h"
21#include "secmpi.h"
22#include "secitem.h"
23#include "blapii.h"

25/* The minimal required randomness is 64 bits */
26/* EXP_BLINDING_RANDOMNESS_LEN is the length of the randomness in mp_digits */
27/* for 32 bits platforts it is 2 mp_digits (= 2 * 32 bits), for 64 bits it is equal to 128 bits */
28#define EXP_BLINDING_RANDOMNESS_LEN((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))) ((128 + MP_DIGIT_BIT(8 * sizeof(mp_digit)) - 1) / MP_DIGIT_BIT(8 * sizeof(mp_digit)))
29#define EXP_BLINDING_RANDOMNESS_LEN_BYTES(((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))
) * sizeof(mp_digit)) (EXP_BLINDING_RANDOMNESS_LEN((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))) * sizeof(mp_digit))

31/*
32** Number of times to attempt to generate a prime (p or q) from a random
33** seed (the seed changes for each iteration).
34*/
35#define MAX_PRIME_GEN_ATTEMPTS10 10
36/*
37** Number of times to attempt to generate a key.  The primes p and q change
38** for each attempt.
39*/
40#define MAX_KEY_GEN_ATTEMPTS10 10

42/* Blinding Parameters max cache size  */
43#define RSA_BLINDING_PARAMS_MAX_CACHE_SIZE20 20

45/* exponent should not be greater than modulus */
46#define BAD_RSA_KEY_SIZE(modLen, expLen)((expLen) > (modLen) || (modLen) > 16384 / 8 || (expLen
) > 64 / 8)                           \
  ((expLen) > (modLen) || (modLen) > RSA_MAX_MODULUS_BITS16384 / 8 || \
   (expLen) > RSA_MAX_EXPONENT_BITS64 / 8)

50struct blindingParamsStr;
51typedef struct blindingParamsStr blindingParams;

53struct blindingParamsStr {
  blindingParams *next;
  mp_int f, g; /* blinding parameter                 */
  int counter; /* number of remaining uses of (f, g) */
57};

59/*
60** RSABlindingParamsStr
61**
62** For discussion of Paul Kocher's timing attack against an RSA private key
63** operation, see http://www.cryptography.com/timingattack/paper.html.  The
64** countermeasure to this attack, known as blinding, is also discussed in
65** the Handbook of Applied Cryptography, 11.118-11.119.
66*/
67struct RSABlindingParamsStr {
  /* Blinding-specific parameters */
  PRCList link;              /* link to list of structs            */
  SECItem modulus;           /* list element "key"                 */
  blindingParams *free, *bp; /* Blinding parameters queue          */
  blindingParams array[RSA_BLINDING_PARAMS_MAX_CACHE_SIZE20];
  /* precalculate montegomery reduction value */
  mp_digit n0i; /* n0i = -( n & MP_DIGIT) ** -1 mod mp_RADIX */
75};
76typedef struct RSABlindingParamsStr RSABlindingParams;

78/*
79** RSABlindingParamsListStr
80**
81** List of key-specific blinding params.  The arena holds the volatile pool
82** of memory for each entry and the list itself.  The lock is for list
83** operations, in this case insertions and iterations, as well as control
84** of the counter for each set of blinding parameters.
85*/
86struct RSABlindingParamsListStr {
  PZLockPRLock *lock;    /* Lock for the list   */
  PRCondVar *cVar; /* Condidtion Variable */
  int waitCount;   /* Number of threads waiting on cVar */
  PRCList head;    /* Pointer to the list */
91};

93/*
94** The master blinding params list.
95*/
96static struct RSABlindingParamsListStr blindingParamsList = { 0 };

98/* Number of times to reuse (f, g).  Suggested by Paul Kocher */
99#define RSA_BLINDING_PARAMS_MAX_REUSE50 50

101/* Global, allows optional use of blinding.  On by default. */
102/* Cannot be changed at the moment, due to thread-safety issues. */
103static PRBool nssRSAUseBlinding = PR_TRUE1;

105static SECStatus
106rsa_build_from_primes(const mp_int *p, const mp_int *q,
                    mp_int *e, PRBool needPublicExponent,
                    mp_int *d, PRBool needPrivateExponent,
                    RSAPrivateKey *key, unsigned int keySizeInBits)
110{
  mp_int n, phi;
  mp_int psub1, qsub1, tmp;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&phi)((&phi)->dp) = 0;
  MP_DIGITS(&psub1)((&psub1)->dp) = 0;
  MP_DIGITS(&qsub1)((&qsub1)->dp) = 0;
  MP_DIGITS(&tmp)((&tmp)->dp) = 0;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
  CHECK_MPI_OK(mp_init(&phi))if (0 > (err = mp_init(&phi))) goto cleanup;
  CHECK_MPI_OK(mp_init(&psub1))if (0 > (err = mp_init(&psub1))) goto cleanup;
  CHECK_MPI_OK(mp_init(&qsub1))if (0 > (err = mp_init(&qsub1))) goto cleanup;
  CHECK_MPI_OK(mp_init(&tmp))if (0 > (err = mp_init(&tmp))) goto cleanup;
  /* p and q must be distinct. */
  if (mp_cmp(p, q) == 0) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NEED_RANDOM);
      rv = SECFailure;
      goto cleanup;
  }
  /* 1.  Compute n = p*q */
  CHECK_MPI_OK(mp_mul(p, q, &n))if (0 > (err = mp_mul(p, q, &n))) goto cleanup;
  /*     verify that the modulus has the desired number of bits */
  if ((unsigned)mpl_significant_bits(&n) != keySizeInBits) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NEED_RANDOM);
      rv = SECFailure;
      goto cleanup;
  }

  /* at least one exponent must be given */
  PORT_Assert(!(needPublicExponent && needPrivateExponent))((!(needPublicExponent && needPrivateExponent))?((void
)0):PR_Assert_stub("!(needPublicExponent && needPrivateExponent)"
,"rsa.c",141));

  /* 2.  Compute phi = (p-1)*(q-1) */
  CHECK_MPI_OK(mp_sub_d(p, 1, &psub1))if (0 > (err = mp_sub_d(p, 1, &psub1))) goto cleanup;
  CHECK_MPI_OK(mp_sub_d(q, 1, &qsub1))if (0 > (err = mp_sub_d(q, 1, &qsub1))) goto cleanup;
  if (needPublicExponent || needPrivateExponent) {
      CHECK_MPI_OK(mp_lcm(&psub1, &qsub1, &phi))if (0 > (err = mp_lcm(&psub1, &qsub1, &phi))) goto
 cleanup;
      /* 3.  Compute d = e**-1 mod(phi) */
      /*     or      e = d**-1 mod(phi) as necessary */
      if (needPublicExponent) {
          err = mp_invmod(d, &phi, e);
      } else {
          err = mp_invmod(e, &phi, d);
      }
  } else {
      err = MP_OKAY0;
  }
  /*     Verify that phi(n) and e have no common divisors */
  if (err != MP_OKAY0) {
      if (err == MP_UNDEF-5) {
          PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NEED_RANDOM);
          err = MP_OKAY0; /* to keep PORT_SetError from being called again */
          rv = SECFailure;
      }
      goto cleanup;
  }

  /* 4.  Compute exponent1 = d mod (p-1) */
  CHECK_MPI_OK(mp_mod(d, &psub1, &tmp))if (0 > (err = mp_mod(d, &psub1, &tmp))) goto cleanup;
  MPINT_TO_SECITEM(&tmp, &key->exponent1, key->arena)do { int mpintLen = mp_unsigned_octet_size(&tmp); if (mpintLen
 <= 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(
key->arena, (&key->exponent1), mpintLen); if ((&
key->exponent1)->data == ((void*)0)) { err = -2; goto cleanup
; } err = mp_to_unsigned_octets(&tmp, (&key->exponent1
)->data, (&key->exponent1)->len); if (err < 0
) goto cleanup; else err = 0; } while (0);
  /* 5.  Compute exponent2 = d mod (q-1) */
  CHECK_MPI_OK(mp_mod(d, &qsub1, &tmp))if (0 > (err = mp_mod(d, &qsub1, &tmp))) goto cleanup;
  MPINT_TO_SECITEM(&tmp, &key->exponent2, key->arena)do { int mpintLen = mp_unsigned_octet_size(&tmp); if (mpintLen
 <= 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(
key->arena, (&key->exponent2), mpintLen); if ((&
key->exponent2)->data == ((void*)0)) { err = -2; goto cleanup
; } err = mp_to_unsigned_octets(&tmp, (&key->exponent2
)->data, (&key->exponent2)->len); if (err < 0
) goto cleanup; else err = 0; } while (0);
  /* 6.  Compute coefficient = q**-1 mod p */
  CHECK_MPI_OK(mp_invmod(q, p, &tmp))if (0 > (err = mp_invmod(q, p, &tmp))) goto cleanup;
  MPINT_TO_SECITEM(&tmp, &key->coefficient, key->arena)do { int mpintLen = mp_unsigned_octet_size(&tmp); if (mpintLen
 <= 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(
key->arena, (&key->coefficient), mpintLen); if ((&
key->coefficient)->data == ((void*)0)) { err = -2; goto
 cleanup; } err = mp_to_unsigned_octets(&tmp, (&key->
coefficient)->data, (&key->coefficient)->len); if
 (err < 0) goto cleanup; else err = 0; } while (0);

  /* copy our calculated results, overwrite what is there */
  key->modulus.data = NULL((void*)0);
  MPINT_TO_SECITEM(&n, &key->modulus, key->arena)do { int mpintLen = mp_unsigned_octet_size(&n); if (mpintLen
 <= 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(
key->arena, (&key->modulus), mpintLen); if ((&key
->modulus)->data == ((void*)0)) { err = -2; goto cleanup
; } err = mp_to_unsigned_octets(&n, (&key->modulus
)->data, (&key->modulus)->len); if (err < 0) goto
 cleanup; else err = 0; } while (0);
  key->privateExponent.data = NULL((void*)0);
  MPINT_TO_SECITEM(d, &key->privateExponent, key->arena)do { int mpintLen = mp_unsigned_octet_size(d); if (mpintLen <=
 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(key->
arena, (&key->privateExponent), mpintLen); if ((&key
->privateExponent)->data == ((void*)0)) { err = -2; goto
 cleanup; } err = mp_to_unsigned_octets(d, (&key->privateExponent
)->data, (&key->privateExponent)->len); if (err <
 0) goto cleanup; else err = 0; } while (0);
  key->publicExponent.data = NULL((void*)0);
  MPINT_TO_SECITEM(e, &key->publicExponent, key->arena)do { int mpintLen = mp_unsigned_octet_size(e); if (mpintLen <=
 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(key->
arena, (&key->publicExponent), mpintLen); if ((&key
->publicExponent)->data == ((void*)0)) { err = -2; goto
 cleanup; } err = mp_to_unsigned_octets(e, (&key->publicExponent
)->data, (&key->publicExponent)->len); if (err <
 0) goto cleanup; else err = 0; } while (0);
  key->prime1.data = NULL((void*)0);
  MPINT_TO_SECITEM(p, &key->prime1, key->arena)do { int mpintLen = mp_unsigned_octet_size(p); if (mpintLen <=
 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(key->
arena, (&key->prime1), mpintLen); if ((&key->prime1
)->data == ((void*)0)) { err = -2; goto cleanup; } err = mp_to_unsigned_octets
(p, (&key->prime1)->data, (&key->prime1)->
len); if (err < 0) goto cleanup; else err = 0; } while (0);
  key->prime2.data = NULL((void*)0);
  MPINT_TO_SECITEM(q, &key->prime2, key->arena)do { int mpintLen = mp_unsigned_octet_size(q); if (mpintLen <=
 0) { err = -3; goto cleanup; } SECITEM_AllocItem_stub(key->
arena, (&key->prime2), mpintLen); if ((&key->prime2
)->data == ((void*)0)) { err = -2; goto cleanup; } err = mp_to_unsigned_octets
(q, (&key->prime2)->data, (&key->prime2)->
len); if (err < 0) goto cleanup; else err = 0; } while (0);
189cleanup:
  mp_clear(&n);
  mp_clear(&phi);
  mp_clear(&psub1);
  mp_clear(&qsub1);
  mp_clear(&tmp);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
200}

202SECStatus
203generate_prime(mp_int *prime, int primeLen)
204{
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  int piter;
  unsigned char *pb = NULL((void*)0);
  pb = PORT_AllocPORT_Alloc_stub(primeLen);
  if (!pb) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      goto cleanup;
  }
  for (piter = 0; piter < MAX_PRIME_GEN_ATTEMPTS10; piter++) {
      CHECK_SEC_OK(RNG_GenerateGlobalRandomBytes(pb, primeLen))if (SECSuccess != (rv = RNG_GenerateGlobalRandomBytes(pb, primeLen
))) goto cleanup;
      pb[0] |= 0xC0;            /* set two high-order bits */
      pb[primeLen - 1] |= 0x01; /* set low-order bit       */
      CHECK_MPI_OK(mp_read_unsigned_octets(prime, pb, primeLen))if (0 > (err = mp_read_unsigned_octets(prime, pb, primeLen
))) goto cleanup;
      err = mpp_make_prime_secure(prime, primeLen * 8, PR_FALSE0);
      if (err != MP_NO-1)
          goto cleanup;
      /* keep going while err == MP_NO */
  }
224cleanup:
  if (pb)
      PORT_ZFreePORT_ZFree_stub(pb, primeLen);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
232}

234/*
*  make sure the key components meet fips186 requirements.
*/
237static PRBool
238rsa_fips186_verify(mp_int *p, mp_int *q, mp_int *d, int keySizeInBits)
239{
  mp_int pq_diff;
  mp_err err = MP_OKAY0;
  PRBool ret = PR_FALSE0;

  if (keySizeInBits < 250) {
      /* not a valid FIPS length, no point in our other tests */
      /* if you are here, and in FIPS mode, you are outside the security
       * policy */
      return PR_TRUE1;
  }

  /* p & q are already known to be greater then sqrt(2)*2^(keySize/2-1) */
  /* we also know that gcd(p-1,e) = 1 and gcd(q-1,e) = 1 because the
   * mp_invmod() function will fail. */
  /* now check p-q > 2^(keysize/2-100) */
  MP_DIGITS(&pq_diff)((&pq_diff)->dp) = 0;
  CHECK_MPI_OK(mp_init(&pq_diff))if (0 > (err = mp_init(&pq_diff))) goto cleanup;
  /* NSS always has p > q, so we know pq_diff is positive */
  CHECK_MPI_OK(mp_sub(p, q, &pq_diff))if (0 > (err = mp_sub(p, q, &pq_diff))) goto cleanup;
  if ((unsigned)mpl_significant_bits(&pq_diff) < (keySizeInBits / 2 - 100)) {
      goto cleanup;
  }
  /* now verify d is large enough*/
  if ((unsigned)mpl_significant_bits(d) < (keySizeInBits / 2)) {
      goto cleanup;
  }
  ret = PR_TRUE1;

268cleanup:
  mp_clear(&pq_diff);
  return ret;
271}

273/*
274** Generate and return a new RSA public and private key.
275**  Both keys are encoded in a single RSAPrivateKey structure.
276**  "cx" is the random number generator context
277**  "keySizeInBits" is the size of the key to be generated, in bits.
278**     512, 1024, etc.
279**  "publicExponent" when not NULL is a pointer to some data that
280**     represents the public exponent to use. The data is a byte
281**     encoded integer, in "big endian" order.
282*/
283RSAPrivateKey *
284RSA_NewKey(int keySizeInBits, SECItem *publicExponent)
285{
  unsigned int primeLen;
  mp_int p = { 0, 0, 0, NULL((void*)0) };
  mp_int q = { 0, 0, 0, NULL((void*)0) };
  mp_int e = { 0, 0, 0, NULL((void*)0) };
  mp_int d = { 0, 0, 0, NULL((void*)0) };
  int kiter;
  int max_attempts;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  int prerr = 0;
  RSAPrivateKey *key = NULL((void*)0);
  PLArenaPool *arena = NULL((void*)0);
  /* Require key size to be a multiple of 16 bits. */
  if (!publicExponent || keySizeInBits % 16 != 0 ||
      BAD_RSA_KEY_SIZE((unsigned int)keySizeInBits / 8, publicExponent->len)((publicExponent->len) > ((unsigned int)keySizeInBits /
 8) || ((unsigned int)keySizeInBits / 8) > 16384 / 8 || (publicExponent
->len) > 64 / 8)) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      return NULL((void*)0);
  }
  /* 1.  Set the public exponent and check if it's uneven and greater than 2.*/
  MP_DIGITS(&e)((&e)->dp) = 0;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  SECITEM_TO_MPINT(*publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (*publicExponent
).data, (*publicExponent).len))) goto cleanup;
  if (mp_iseven(&e) || !(mp_cmp_d(&e, 2) > 0)) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      goto cleanup;
  }
312#ifndef NSS_FIPS_DISABLED
  /* Check that the exponent is not smaller than 65537  */
  if (mp_cmp_d(&e, 0x10001) < 0) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      goto cleanup;
  }
318#endif

  /* 2. Allocate arena & key */
  arena = PORT_NewArenaPORT_NewArena_stub(NSS_FREEBL_DEFAULT_CHUNKSIZE2048);
  if (!arena) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      goto cleanup;
  }
  key = PORT_ArenaZNew(arena, RSAPrivateKey)(RSAPrivateKey *)PORT_ArenaZAlloc_stub(arena, sizeof(RSAPrivateKey
));
  if (!key) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      goto cleanup;
  }
  key->arena = arena;
  /* length of primes p and q (in bytes) */
  primeLen = keySizeInBits / (2 * PR_BITS_PER_BYTE8);
  MP_DIGITS(&p)((&p)->dp) = 0;
  MP_DIGITS(&q)((&q)->dp) = 0;
  MP_DIGITS(&d)((&d)->dp) = 0;
  CHECK_MPI_OK(mp_init(&p))if (0 > (err = mp_init(&p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&q))if (0 > (err = mp_init(&q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d))if (0 > (err = mp_init(&d))) goto cleanup;
  /* 3.  Set the version number (PKCS1 v1.5 says it should be zero) */
  SECITEM_AllocItemSECITEM_AllocItem_stub(arena, &key->version, 1);
  key->version.data[0] = 0;

  kiter = 0;
  max_attempts = 5 * (keySizeInBits / 2); /* FIPS 186-4 B.3.3 steps 4.7 and 5.8 */
  do {
      PORT_SetErrorPORT_SetError_stub(0);
      CHECK_SEC_OK(generate_prime(&p, primeLen))if (SECSuccess != (rv = generate_prime(&p, primeLen))) goto
 cleanup;
      CHECK_SEC_OK(generate_prime(&q, primeLen))if (SECSuccess != (rv = generate_prime(&q, primeLen))) goto
 cleanup;
      /* Assure p > q */
      /* NOTE: PKCS #1 does not require p > q, and NSS doesn't use any
       * implementation optimization that requires p > q. We can remove
       * this code in the future.
       */
      if (mp_cmp(&p, &q) < 0)
          mp_exch(&p, &q);
      /* Attempt to use these primes to generate a key */
      rv = rsa_build_from_primes(&p, &q,
                                 &e, PR_FALSE0, /* needPublicExponent=false */
                                 &d, PR_TRUE1,  /* needPrivateExponent=true */
                                 key, keySizeInBits);
      if (rv == SECSuccess) {
          if (rsa_fips186_verify(&p, &q, &d, keySizeInBits)) {
              break;
          }
          prerr = SEC_ERROR_NEED_RANDOM; /* retry with different values */
      } else {
          prerr = PORT_GetErrorPORT_GetError_stub();
      }
      kiter++;
      /* loop until have primes */
  } while (prerr == SEC_ERROR_NEED_RANDOM && kiter < max_attempts);

374cleanup:
  mp_clear(&p);
  mp_clear(&q);
  mp_clear(&e);
  mp_clear(&d);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  if (rv && arena) {
      PORT_FreeArenaPORT_FreeArena_stub(arena, PR_TRUE1);
      key = NULL((void*)0);
  }
  return key;
388}

390mp_err
391rsa_is_prime(mp_int *p)
392{
  int res;

  /* run a Fermat test */
  res = mpp_fermat(p, 2);
  if (res != MP_OKAY0) {
      return res;
  }

  /* If that passed, run some Miller-Rabin tests */
  res = mpp_pprime_secure(p, 2);
  return res;
404}

406/*
* Factorize a RSA modulus n into p and q by using the exponents e and d.
*
* In: e, d, n
* Out: p, q
*
* See Handbook of Applied Cryptography, 8.2.2(i).
*
* The algorithm is probabilistic, it is run 64 times and each run has a 50%
* chance of succeeding with a runtime of O(log(e*d)).
*
* The returned p might be smaller than q.
*/
419static mp_err
420rsa_factorize_n_from_exponents(mp_int *e, mp_int *d, mp_int *p, mp_int *q,
                             mp_int *n)
422{
  /* lambda is the private modulus: e*d = 1 mod lambda */
  /* so: e*d - 1 = k*lambda = t*2^s where t is odd */
  mp_int klambda;
  mp_int t, onetwentyeight;
  unsigned long s = 0;
  unsigned long i;

  /* cand = a^(t * 2^i) mod n, next_cand = a^(t * 2^(i+1)) mod n */
  mp_int a;
  mp_int cand;
  mp_int next_cand;

  mp_int n_minus_one;
  mp_err err = MP_OKAY0;

  MP_DIGITS(&klambda)((&klambda)->dp) = 0;
  MP_DIGITS(&t)((&t)->dp) = 0;
  MP_DIGITS(&a)((&a)->dp) = 0;
  MP_DIGITS(&cand)((&cand)->dp) = 0;
  MP_DIGITS(&n_minus_one)((&n_minus_one)->dp) = 0;
  MP_DIGITS(&next_cand)((&next_cand)->dp) = 0;
  MP_DIGITS(&onetwentyeight)((&onetwentyeight)->dp) = 0;
  CHECK_MPI_OK(mp_init(&klambda))if (0 > (err = mp_init(&klambda))) goto cleanup;
  CHECK_MPI_OK(mp_init(&t))if (0 > (err = mp_init(&t))) goto cleanup;
  CHECK_MPI_OK(mp_init(&a))if (0 > (err = mp_init(&a))) goto cleanup;
  CHECK_MPI_OK(mp_init(&cand))if (0 > (err = mp_init(&cand))) goto cleanup;
  CHECK_MPI_OK(mp_init(&n_minus_one))if (0 > (err = mp_init(&n_minus_one))) goto cleanup;
  CHECK_MPI_OK(mp_init(&next_cand))if (0 > (err = mp_init(&next_cand))) goto cleanup;
  CHECK_MPI_OK(mp_init(&onetwentyeight))if (0 > (err = mp_init(&onetwentyeight))) goto cleanup;

  mp_set_int(&onetwentyeight, 128);

  /* calculate k*lambda = e*d - 1 */
  CHECK_MPI_OK(mp_mul(e, d, &klambda))if (0 > (err = mp_mul(e, d, &klambda))) goto cleanup;
  CHECK_MPI_OK(mp_sub_d(&klambda, 1, &klambda))if (0 > (err = mp_sub_d(&klambda, 1, &klambda))) goto
 cleanup;

  /* factorize klambda into t*2^s */
  CHECK_MPI_OK(mp_copy(&klambda, &t))if (0 > (err = mp_copy(&klambda, &t))) goto cleanup;
  while (mpp_divis_d(&t, 2) == MP_YES0) {
      CHECK_MPI_OK(mp_div_2(&t, &t))if (0 > (err = mp_div_2(&t, &t))) goto cleanup;
      s += 1;
  }

  /* precompute n_minus_one = n - 1 */
  CHECK_MPI_OK(mp_copy(n, &n_minus_one))if (0 > (err = mp_copy(n, &n_minus_one))) goto cleanup;
  CHECK_MPI_OK(mp_sub_d(&n_minus_one, 1, &n_minus_one))if (0 > (err = mp_sub_d(&n_minus_one, 1, &n_minus_one
))) goto cleanup;

  /* pick random bases a, each one has a 50% leading to a factorization */
  CHECK_MPI_OK(mp_set_int(&a, 2))if (0 > (err = mp_set_int(&a, 2))) goto cleanup;
  /* The following is equivalent to for (a=2, a <= 128, a+=2) */
  while (mp_cmp(&a, &onetwentyeight) <= 0) {
      /* compute the base cand = a^(t * 2^0) [i = 0] */
      CHECK_MPI_OK(mp_exptmod(&a, &t, n, &cand))if (0 > (err = mp_exptmod(&a, &t, n, &cand))) goto
 cleanup;

      for (i = 0; i < s; i++) {
          /* condition 1: skip the base if we hit a trivial factor of n */
          if (mp_cmp(&cand, &n_minus_one) == 0 || mp_cmp_d(&cand, 1) == 0) {
              break;
          }

          /* increase i in a^(t * 2^i) by squaring the number */
          CHECK_MPI_OK(mp_exptmod_d(&cand, 2, n, &next_cand))if (0 > (err = mp_exptmod_d(&cand, 2, n, &next_cand
))) goto cleanup;

          /* condition 2: a^(t * 2^(i+1)) = 1 mod n */
          if (mp_cmp_d(&next_cand, 1) == 0) {
              /* conditions verified, gcd(a^(t * 2^i) - 1, n) is a factor */
              CHECK_MPI_OK(mp_sub_d(&cand, 1, &cand))if (0 > (err = mp_sub_d(&cand, 1, &cand))) goto cleanup;
              CHECK_MPI_OK(mp_gcd(&cand, n, p))if (0 > (err = mp_gcd(&cand, n, p))) goto cleanup;
              if (mp_cmp_d(p, 1) == 0) {
                  CHECK_MPI_OK(mp_add_d(&cand, 1, &cand))if (0 > (err = mp_add_d(&cand, 1, &cand))) goto cleanup;
                  break;
              }
              CHECK_MPI_OK(mp_div(n, p, q, NULL))if (0 > (err = mp_div(n, p, q, ((void*)0)))) goto cleanup;
              goto cleanup;
          }
          CHECK_MPI_OK(mp_copy(&next_cand, &cand))if (0 > (err = mp_copy(&next_cand, &cand))) goto cleanup;
      }

      CHECK_MPI_OK(mp_add_d(&a, 2, &a))if (0 > (err = mp_add_d(&a, 2, &a))) goto cleanup;
  }

  /* if we reach here it's likely (2^64 - 1 / 2^64) that d is wrong */
  err = MP_RANGE-3;

507cleanup:
  mp_clear(&klambda);
  mp_clear(&t);
  mp_clear(&a);
  mp_clear(&cand);
  mp_clear(&n_minus_one);
  mp_clear(&next_cand);
  mp_clear(&onetwentyeight);
  return err;
516}

518/*
* Try to find the two primes based on 2 exponents plus a prime.
*
* In: e, d and p.
* Out: p,q.
*
* Step 1, Since d = e**-1 mod phi, we know that d*e == 1 mod phi, or
*  d*e = 1+k*phi, or d*e-1 = k*phi. since d is less than phi and e is
*  usually less than d, then k must be an integer between e-1 and 1
*  (probably on the order of e).
* Step 1a, We can divide k*phi by prime-1 and get k*(q-1). This will reduce
*      the size of our division through the rest of the loop.
* Step 2, Loop through the values k=e-1 to 1 looking for k. k should be on
*  the order or e, and e is typically small. This may take a while for
*  a large random e. We are looking for a k that divides kphi
*  evenly. Once we find a k that divides kphi evenly, we assume it
*  is the true k. It's possible this k is not the 'true' k but has
*  swapped factors of p-1 and/or q-1. Because of this, we
*  tentatively continue Steps 3-6 inside this loop, and may return looking
*  for another k on failure.
* Step 3, Calculate our tentative phi=kphi/k. Note: real phi is (p-1)*(q-1).
* Step 4a, kphi is k*(q-1), so phi is our tenative q-1. q = phi+1.
*      If k is correct, q should be the right length and prime.
* Step 4b, It's possible q-1 and k could have swapped factors. We now have a
*  possible solution that meets our criteria. It may not be the only
*      solution, however, so we keep looking. If we find more than one,
*      we will fail since we cannot determine which is the correct
*      solution, and returning the wrong modulus will compromise both
*      moduli. If no other solution is found, we return the unique solution.
*
* This will return p & q. q may be larger than p in the case that p was given
* and it was the smaller prime.
*/
551static mp_err
552rsa_get_prime_from_exponents(mp_int *e, mp_int *d, mp_int *p, mp_int *q,
                           mp_int *n, unsigned int keySizeInBits)
554{
  mp_int kphi; /* k*phi */
  mp_int k;    /* current guess at 'k' */
  mp_int phi;  /* (p-1)(q-1) */
  mp_int r;    /* remainder */
  mp_int tmp;  /* p-1 if p is given */
  mp_err err = MP_OKAY0;
  unsigned int order_k;

  MP_DIGITS(&kphi)((&kphi)->dp) = 0;
  MP_DIGITS(&phi)((&phi)->dp) = 0;
  MP_DIGITS(&k)((&k)->dp) = 0;
  MP_DIGITS(&r)((&r)->dp) = 0;
  MP_DIGITS(&tmp)((&tmp)->dp) = 0;
  CHECK_MPI_OK(mp_init(&kphi))if (0 > (err = mp_init(&kphi))) goto cleanup;
  CHECK_MPI_OK(mp_init(&phi))if (0 > (err = mp_init(&phi))) goto cleanup;
  CHECK_MPI_OK(mp_init(&k))if (0 > (err = mp_init(&k))) goto cleanup;
  CHECK_MPI_OK(mp_init(&r))if (0 > (err = mp_init(&r))) goto cleanup;
  CHECK_MPI_OK(mp_init(&tmp))if (0 > (err = mp_init(&tmp))) goto cleanup;

  /* our algorithm looks for a factor k whose maximum size is dependent
   * on the size of our smallest exponent, which had better be the public
   * exponent (if it's the private, the key is vulnerable to a brute force
   * attack).
   *
   * since our factor search is linear, we need to limit the maximum
   * size of the public key. this should not be a problem normally, since
   * public keys are usually small.
   *
   * if we want to handle larger public key sizes, we should have
   * a version which tries to 'completely' factor k*phi (where completely
   * means 'factor into primes, or composites with which are products of
   * large primes). Once we have all the factors, we can sort them out and
   * try different combinations to form our phi. The risk is if (p-1)/2,
   * (q-1)/2, and k are all large primes. In any case if the public key
   * is small (order of 20 some bits), then a linear search for k is
   * manageable.
   */
  if (mpl_significant_bits(e) > 23) {
      err = MP_RANGE-3;
      goto cleanup;
  }

  /* calculate k*phi = e*d - 1 */
  CHECK_MPI_OK(mp_mul(e, d, &kphi))if (0 > (err = mp_mul(e, d, &kphi))) goto cleanup;
  CHECK_MPI_OK(mp_sub_d(&kphi, 1, &kphi))if (0 > (err = mp_sub_d(&kphi, 1, &kphi))) goto cleanup;

  /* kphi is (e*d)-1, which is the same as k*(p-1)(q-1)
   * d < (p-1)(q-1), therefor k must be less than e-1
   * We can narrow down k even more, though. Since p and q are odd and both
   * have their high bit set, then we know that phi must be on order of
   * keySizeBits.
   */
  order_k = (unsigned)mpl_significant_bits(&kphi) - keySizeInBits;

  if (order_k <= 1) {
      err = MP_RANGE-3;
      goto cleanup;
  }

  /* for (k=kinit; order(k) >= order_k; k--) { */
  /* k=kinit: k can't be bigger than  kphi/2^(keySizeInBits -1) */
  CHECK_MPI_OK(mp_2expt(&k, keySizeInBits - 1))if (0 > (err = mp_2expt(&k, keySizeInBits - 1))) goto cleanup;
  CHECK_MPI_OK(mp_div(&kphi, &k, &k, NULL))if (0 > (err = mp_div(&kphi, &k, &k, ((void*)0
)))) goto cleanup;
  if (mp_cmp(&k, e) >= 0) {
      /* also can't be bigger then e-1 */
      CHECK_MPI_OK(mp_sub_d(e, 1, &k))if (0 > (err = mp_sub_d(e, 1, &k))) goto cleanup;
  }

  /* calculate our temp value */
  /* This saves recalculating this value when the k guess is wrong, which
   * is reasonably frequent. */
  /* tmp = p-1 (used to calculate q-1= phi/tmp) */
  CHECK_MPI_OK(mp_sub_d(p, 1, &tmp))if (0 > (err = mp_sub_d(p, 1, &tmp))) goto cleanup;
  CHECK_MPI_OK(mp_div(&kphi, &tmp, &kphi, &r))if (0 > (err = mp_div(&kphi, &tmp, &kphi, &
r))) goto cleanup;
  if (mp_cmp_z(&r) != 0) {
      /* p-1 doesn't divide kphi, some parameter wasn't correct */
      err = MP_RANGE-3;
      goto cleanup;
  }
  mp_zero(q);
  /* kphi is now k*(q-1) */

  /* rest of the for loop */
  for (; (err == MP_OKAY0) && (mpl_significant_bits(&k) >= order_k);
       err = mp_sub_d(&k, 1, &k)) {
      CHECK_MPI_OK(err)if (0 > (err = err)) goto cleanup;
      /* looking for k as a factor of kphi */
      CHECK_MPI_OK(mp_div(&kphi, &k, &phi, &r))if (0 > (err = mp_div(&kphi, &k, &phi, &r)
)) goto cleanup;
      if (mp_cmp_z(&r) != 0) {
          /* not a factor, try the next one */
          continue;
      }
      /* we have a possible phi, see if it works */
      if ((unsigned)mpl_significant_bits(&phi) != keySizeInBits / 2) {
          /* phi is not the right size */
          continue;
      }
      /* phi should be divisible by 2, since
       * q is odd and phi=(q-1). */
      if (mpp_divis_d(&phi, 2) == MP_NO-1) {
          /* phi is not divisible by 4 */
          continue;
      }
      /* we now have a candidate for the second prime */
      CHECK_MPI_OK(mp_add_d(&phi, 1, &tmp))if (0 > (err = mp_add_d(&phi, 1, &tmp))) goto cleanup;

      /* check to make sure it is prime */
      err = rsa_is_prime(&tmp);
      if (err != MP_OKAY0) {
          if (err == MP_NO-1) {
              /* No, then we still have the wrong phi */
              continue;
          }
          goto cleanup;
      }
      /*
       * It is possible that we have the wrong phi if
       * k_guess*(q_guess-1) = k*(q-1) (k and q-1 have swapped factors).
       * since our q_quess is prime, however. We have found a valid
       * rsa key because:
       *   q is the correct order of magnitude.
       *   phi = (p-1)(q-1) where p and q are both primes.
       *   e*d mod phi = 1.
       * There is no way to know from the info given if this is the
       * original key. We never want to return the wrong key because if
       * two moduli with the same factor is known, then euclid's gcd
       * algorithm can be used to find that factor. Even though the
       * caller didn't pass the original modulus, it doesn't mean the
       * modulus wasn't known or isn't available somewhere. So to be safe
       * if we can't be sure we have the right q, we don't return any.
       *
       * So to make sure we continue looking for other valid q's. If none
       * are found, then we can safely return this one, otherwise we just
       * fail */
      if (mp_cmp_z(q) != 0) {
          /* this is the second valid q, don't return either,
           * just fail */
          err = MP_RANGE-3;
          break;
      }
      /* we only have one q so far, save it and if no others are found,
       * it's safe to return it */
      CHECK_MPI_OK(mp_copy(&tmp, q))if (0 > (err = mp_copy(&tmp, q))) goto cleanup;
      continue;
  }
  if ((unsigned)mpl_significant_bits(&k) < order_k) {
      if (mp_cmp_z(q) == 0) {
          /* If we get here, something was wrong with the parameters we
           * were given */
          err = MP_RANGE-3;
      }
  }
707cleanup:
  mp_clear(&kphi);
  mp_clear(&phi);
  mp_clear(&k);
  mp_clear(&r);
  mp_clear(&tmp);
  return err;
714}

716/*
* take a private key with only a few elements and fill out the missing pieces.
*
* All the entries will be overwritten with data allocated out of the arena
* If no arena is supplied, one will be created.
*
* The following fields must be supplied in order for this function
* to succeed:
*   one of either publicExponent or privateExponent
*   two more of the following 5 parameters.
*      modulus (n)
*      prime1  (p)
*      prime2  (q)
*      publicExponent (e)
*      privateExponent (d)
*
* NOTE: if only the publicExponent, privateExponent, and one prime is given,
* then there may be more than one RSA key that matches that combination.
*
* All parameters will be replaced in the key structure with new parameters
* Allocated out of the arena. There is no attempt to free the old structures.
* Prime1 will always be greater than prime2 (even if the caller supplies the
* smaller prime as prime1 or the larger prime as prime2). The parameters are
* not overwritten on failure.
*
*  How it works:
*     We can generate all the parameters from one of the exponents, plus the
*        two primes. (rsa_build_key_from_primes)
*     If we are given one of the exponents and both primes, we are done.
*     If we are given one of the exponents, the modulus and one prime, we
*        caclulate the second prime by dividing the modulus by the given
*        prime, giving us an exponent and 2 primes.
*     If we are given 2 exponents and one of the primes we calculate
*        k*phi = d*e-1, where k is an integer less than d which
*        divides d*e-1. We find factor k so we can isolate phi.
*            phi = (p-1)(q-1)
*        We can use phi to find the other prime as follows:
*        q = (phi/(p-1)) + 1. We now have 2 primes and an exponent.
*        (NOTE: if more then one prime meets this condition, the operation
*        will fail. See comments elsewhere in this file about this).
*        (rsa_get_prime_from_exponents)
*     If we are given 2 exponents and the modulus we factor the modulus to
*        get the 2 missing primes (rsa_factorize_n_from_exponents)
*
*/
761SECStatus
762RSA_PopulatePrivateKey(RSAPrivateKey *key)
763{
  PLArenaPool *arena = NULL((void*)0);
  PRBool needPublicExponent = PR_TRUE1;
  PRBool needPrivateExponent = PR_TRUE1;
  PRBool hasModulus = PR_FALSE0;
  unsigned int keySizeInBits = 0;
  int prime_count = 0;
  /* standard RSA nominclature */
  mp_int p, q, e, d, n;
  /* remainder */
  mp_int r;
  mp_err err = 0;
  SECStatus rv = SECFailure;

  MP_DIGITS(&p)((&p)->dp) = 0;
  MP_DIGITS(&q)((&q)->dp) = 0;
  MP_DIGITS(&e)((&e)->dp) = 0;
  MP_DIGITS(&d)((&d)->dp) = 0;
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&r)((&r)->dp) = 0;
  CHECK_MPI_OK(mp_init(&p))if (0 > (err = mp_init(&p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&q))if (0 > (err = mp_init(&q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d))if (0 > (err = mp_init(&d))) goto cleanup;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
  CHECK_MPI_OK(mp_init(&r))if (0 > (err = mp_init(&r))) goto cleanup;

  /* if the key didn't already have an arena, create one. */
  if (key->arena == NULL((void*)0)) {
      arena = PORT_NewArenaPORT_NewArena_stub(NSS_FREEBL_DEFAULT_CHUNKSIZE2048);
      if (!arena) {
          goto cleanup;
      }
      key->arena = arena;
  }

  /* load up the known exponents */
  if (key->publicExponent.data) {
      SECITEM_TO_MPINT(key->publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (key->
publicExponent).data, (key->publicExponent).len))) goto cleanup;
      needPublicExponent = PR_FALSE0;
  }
  if (key->privateExponent.data) {
      SECITEM_TO_MPINT(key->privateExponent, &d)if (0 > (err = mp_read_unsigned_octets((&d), (key->
privateExponent).data, (key->privateExponent).len))) goto cleanup;
      needPrivateExponent = PR_FALSE0;
  }
  if (needPrivateExponent && needPublicExponent) {
      /* Not enough information, we need at least one exponent */
      err = MP_BADARG-4;
      goto cleanup;
  }

  /* load up the known primes. If only one prime is given, it will be
   * assigned 'p'. Once we have both primes, well make sure p is the larger.
   * The value prime_count tells us howe many we have acquired.
   */
  if (key->prime1.data) {
      int primeLen = key->prime1.len;
      if (key->prime1.data[0] == 0) {
          primeLen--;
      }
      keySizeInBits = primeLen * 2 * PR_BITS_PER_BYTE8;
      SECITEM_TO_MPINT(key->prime1, &p)if (0 > (err = mp_read_unsigned_octets((&p), (key->
prime1).data, (key->prime1).len))) goto cleanup;
      prime_count++;
  }
  if (key->prime2.data) {
      int primeLen = key->prime2.len;
      if (key->prime2.data[0] == 0) {
          primeLen--;
      }
      keySizeInBits = primeLen * 2 * PR_BITS_PER_BYTE8;
      SECITEM_TO_MPINT(key->prime2, prime_count ? &q : &p)if (0 > (err = mp_read_unsigned_octets((prime_count ? &
q : &p), (key->prime2).data, (key->prime2).len))) goto
 cleanup;
      prime_count++;
  }
  /* load up the modulus */
  if (key->modulus.data) {
      int modLen = key->modulus.len;
      if (key->modulus.data[0] == 0) {
          modLen--;
      }
      keySizeInBits = modLen * PR_BITS_PER_BYTE8;
      SECITEM_TO_MPINT(key->modulus, &n)if (0 > (err = mp_read_unsigned_octets((&n), (key->
modulus).data, (key->modulus).len))) goto cleanup;
      hasModulus = PR_TRUE1;
  }
  /* if we have the modulus and one prime, calculate the second. */
  if ((prime_count == 1) && (hasModulus)) {
      if (mp_div(&n, &p, &q, &r) != MP_OKAY0 || mp_cmp_z(&r) != 0) {
          /* p is not a factor or n, fail */
          err = MP_BADARG-4;
          goto cleanup;
      }
      prime_count++;
  }

  /* If we didn't have enough primes try to calculate the primes from
   * the exponents */
  if (prime_count < 2) {
      /* if we don't have at least 2 primes at this point, then we need both
       * exponents and one prime or a modulus*/
      if (!needPublicExponent && !needPrivateExponent &&
          (prime_count > 0)) {
          CHECK_MPI_OK(rsa_get_prime_from_exponents(&e, &d, &p, &q, &n,if (0 > (err = rsa_get_prime_from_exponents(&e, &d
, &p, &q, &n, keySizeInBits))) goto cleanup
                                                    keySizeInBits))if (0 > (err = rsa_get_prime_from_exponents(&e, &d
, &p, &q, &n, keySizeInBits))) goto cleanup;
      } else if (!needPublicExponent && !needPrivateExponent && hasModulus) {
          CHECK_MPI_OK(rsa_factorize_n_from_exponents(&e, &d, &p, &q, &n))if (0 > (err = rsa_factorize_n_from_exponents(&e, &
d, &p, &q, &n))) goto cleanup;
      } else {
          /* not enough given parameters to get both primes */
          err = MP_BADARG-4;
          goto cleanup;
      }
  }

  /* Assure p > q */
  /* NOTE: PKCS #1 does not require p > q, and NSS doesn't use any
    * implementation optimization that requires p > q. We can remove
    * this code in the future.
    */
  if (mp_cmp(&p, &q) < 0)
      mp_exch(&p, &q);

  /* we now have our 2 primes and at least one exponent, we can fill
    * in the key */
  rv = rsa_build_from_primes(&p, &q,
                             &e, needPublicExponent,
                             &d, needPrivateExponent,
                             key, keySizeInBits);
888cleanup:
  mp_clear(&p);
  mp_clear(&q);
  mp_clear(&e);
  mp_clear(&d);
  mp_clear(&n);
  mp_clear(&r);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  if (rv && arena) {
      PORT_FreeArenaPORT_FreeArena_stub(arena, PR_TRUE1);
      key->arena = NULL((void*)0);
  }
  return rv;
904}

906static unsigned int
907rsa_modulusLen(SECItem *modulus)
908{
  if (modulus->len == 0) {
      return 0;
  };
  unsigned char byteZero = modulus->data[0];
  unsigned int modLen = modulus->len - !byteZero;
  return modLen;
915}

917/*
918** Perform a raw public-key operation
919**  Length of input and output buffers are equal to key's modulus len.
920*/
921SECStatus
922RSA_PublicKeyOp(RSAPublicKey *key,
              unsigned char *output,
              const unsigned char *input)
925{
  unsigned int modLen, expLen, offset;
  mp_int n, e, m, c;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  if (!key || !output || !input) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&e)((&e)->dp) = 0;
  MP_DIGITS(&m)((&m)->dp) = 0;
  MP_DIGITS(&c)((&c)->dp) = 0;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  CHECK_MPI_OK(mp_init(&m))if (0 > (err = mp_init(&m))) goto cleanup;
  CHECK_MPI_OK(mp_init(&c))if (0 > (err = mp_init(&c))) goto cleanup;
  modLen = rsa_modulusLen(&key->modulus);
  expLen = rsa_modulusLen(&key->publicExponent);

  if (modLen == 0) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      rv = SECFailure;
      goto cleanup;
  }

  /* 1.  Obtain public key (n, e) */
  if (BAD_RSA_KEY_SIZE(modLen, expLen)((expLen) > (modLen) || (modLen) > 16384 / 8 || (expLen
) > 64 / 8)) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_KEY);
      rv = SECFailure;
      goto cleanup;
  }
  SECITEM_TO_MPINT(key->modulus, &n)if (0 > (err = mp_read_unsigned_octets((&n), (key->
modulus).data, (key->modulus).len))) goto cleanup;
  SECITEM_TO_MPINT(key->publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (key->
publicExponent).data, (key->publicExponent).len))) goto cleanup;
  if (e.used > n.used) {
      /* exponent should not be greater than modulus */
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_KEY);
      rv = SECFailure;
      goto cleanup;
  }
  /* 2. check input out of range (needs to be in range [0..n-1]) */
  offset = (key->modulus.data[0] == 0) ? 1 : 0; /* may be leading 0 */
  if (memcmp(input, key->modulus.data + offset, modLen) >= 0) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INPUT_LEN);
      rv = SECFailure;
      goto cleanup;
  }
  /* 2 bis.  Represent message as integer in range [0..n-1] */
  CHECK_MPI_OK(mp_read_unsigned_octets(&m, input, modLen))if (0 > (err = mp_read_unsigned_octets(&m, input, modLen
))) goto cleanup;
974/* 3.  Compute c = m**e mod n */
975#ifdef USE_MPI_EXPT_D
  /* XXX see which is faster */
  if (MP_USED(&e)((&e)->used) == 1) {
      CHECK_MPI_OK(mp_exptmod_d(&m, MP_DIGIT(&e, 0), &n, &c))if (0 > (err = mp_exptmod_d(&m, (&e)->dp[(0)], &
n, &c))) goto cleanup;
  } else
980#endif
      CHECK_MPI_OK(mp_exptmod(&m, &e, &n, &c))if (0 > (err = mp_exptmod(&m, &e, &n, &c))
) goto cleanup;
  /* 4.  result c is ciphertext */
  err = mp_to_fixlen_octets(&c, output, modLen);
  if (err >= 0)
      err = MP_OKAY0;
986cleanup:
  mp_clear(&n);
  mp_clear(&e);
  mp_clear(&m);
  mp_clear(&c);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
996}

998/*
999**  RSA Private key operation (no CRT).
1000*/
1001static SECStatus
1002rsa_PrivateKeyOpNoCRT(RSAPrivateKey *key, mp_int *m, mp_int *c, mp_int *n,
                    unsigned int modLen)
1004{
  mp_int d;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  MP_DIGITS(&d)((&d)->dp) = 0;
  CHECK_MPI_OK(mp_init(&d))if (0 > (err = mp_init(&d))) goto cleanup;
  SECITEM_TO_MPINT(key->privateExponent, &d)if (0 > (err = mp_read_unsigned_octets((&d), (key->
privateExponent).data, (key->privateExponent).len))) goto cleanup;
  /* 1. m = c**d mod n */
  CHECK_MPI_OK(mp_exptmod(c, &d, n, m))if (0 > (err = mp_exptmod(c, &d, n, m))) goto cleanup;
1013cleanup:
  mp_clear(&d);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1020}

1022/*
1023**  RSA Private key operation using CRT.
1024*/
1025static SECStatus
1026rsa_PrivateKeyOpCRTNoCheck(RSAPrivateKey *key, mp_int *m, mp_int *c)
1027{
  mp_int p, q, d_p, d_q, qInv;
  /*
          The length of the randomness comes from the papers: 
          https://link.springer.com/chapter/10.1007/978-3-642-29912-4_7
          https://link.springer.com/chapter/10.1007/978-3-642-21554-4_5. 
      */
  mp_int blinding_dp, blinding_dq, r1, r2;
  unsigned char random_block[EXP_BLINDING_RANDOMNESS_LEN_BYTES(((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))
) * sizeof(mp_digit))];
  mp_int m1, m2, h, ctmp;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  MP_DIGITS(&p)((&p)->dp) = 0;
  MP_DIGITS(&q)((&q)->dp) = 0;
  MP_DIGITS(&d_p)((&d_p)->dp) = 0;
  MP_DIGITS(&d_q)((&d_q)->dp) = 0;
  MP_DIGITS(&qInv)((&qInv)->dp) = 0;
  MP_DIGITS(&m1)((&m1)->dp) = 0;
  MP_DIGITS(&m2)((&m2)->dp) = 0;
  MP_DIGITS(&h)((&h)->dp) = 0;
  MP_DIGITS(&ctmp)((&ctmp)->dp) = 0;
  MP_DIGITS(&blinding_dp)((&blinding_dp)->dp) = 0;
  MP_DIGITS(&blinding_dq)((&blinding_dq)->dp) = 0;
  MP_DIGITS(&r1)((&r1)->dp) = 0;
  MP_DIGITS(&r2)((&r2)->dp) = 0;

  CHECK_MPI_OK(mp_init(&p))if (0 > (err = mp_init(&p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&q))if (0 > (err = mp_init(&q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d_p))if (0 > (err = mp_init(&d_p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d_q))if (0 > (err = mp_init(&d_q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&qInv))if (0 > (err = mp_init(&qInv))) goto cleanup;
  CHECK_MPI_OK(mp_init(&m1))if (0 > (err = mp_init(&m1))) goto cleanup;
  CHECK_MPI_OK(mp_init(&m2))if (0 > (err = mp_init(&m2))) goto cleanup;
  CHECK_MPI_OK(mp_init(&h))if (0 > (err = mp_init(&h))) goto cleanup;
  CHECK_MPI_OK(mp_init(&ctmp))if (0 > (err = mp_init(&ctmp))) goto cleanup;
  CHECK_MPI_OK(mp_init(&blinding_dp))if (0 > (err = mp_init(&blinding_dp))) goto cleanup;
  CHECK_MPI_OK(mp_init(&blinding_dq))if (0 > (err = mp_init(&blinding_dq))) goto cleanup;
  CHECK_MPI_OK(mp_init_size(&r1, EXP_BLINDING_RANDOMNESS_LEN))if (0 > (err = mp_init_size(&r1, ((128 + (8 * sizeof(mp_digit
)) - 1) / (8 * sizeof(mp_digit)))))) goto cleanup;
  CHECK_MPI_OK(mp_init_size(&r2, EXP_BLINDING_RANDOMNESS_LEN))if (0 > (err = mp_init_size(&r2, ((128 + (8 * sizeof(mp_digit
)) - 1) / (8 * sizeof(mp_digit)))))) goto cleanup;

  /* copy private key parameters into mp integers */
  SECITEM_TO_MPINT(key->prime1, &p)if (0 > (err = mp_read_unsigned_octets((&p), (key->
prime1).data, (key->prime1).len))) goto cleanup;         /* p */
  SECITEM_TO_MPINT(key->prime2, &q)if (0 > (err = mp_read_unsigned_octets((&q), (key->
prime2).data, (key->prime2).len))) goto cleanup;         /* q */
  SECITEM_TO_MPINT(key->exponent1, &d_p)if (0 > (err = mp_read_unsigned_octets((&d_p), (key->
exponent1).data, (key->exponent1).len))) goto cleanup;    /* d_p  = d mod (p-1) */
  SECITEM_TO_MPINT(key->exponent2, &d_q)if (0 > (err = mp_read_unsigned_octets((&d_q), (key->
exponent2).data, (key->exponent2).len))) goto cleanup;    /* d_q  = d mod (q-1) */
  SECITEM_TO_MPINT(key->coefficient, &qInv)if (0 > (err = mp_read_unsigned_octets((&qInv), (key->
coefficient).data, (key->coefficient).len))) goto cleanup; /* qInv = q**-1 mod p */

  // blinding_dp = 1
  CHECK_MPI_OK(mp_set_int(&blinding_dp, 1))if (0 > (err = mp_set_int(&blinding_dp, 1))) goto cleanup;
  // blinding_dp = p - 1
  CHECK_MPI_OK(mp_sub(&p, &blinding_dp, &blinding_dp))if (0 > (err = mp_sub(&p, &blinding_dp, &blinding_dp
))) goto cleanup;
  // generating a random value
  RNG_GenerateGlobalRandomBytes(random_block, EXP_BLINDING_RANDOMNESS_LEN_BYTES(((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))
) * sizeof(mp_digit)));
  MP_USED(&r1)((&r1)->used) = EXP_BLINDING_RANDOMNESS_LEN((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit)));
  memcpy(MP_DIGITS(&r1)((&r1)->dp), random_block, sizeof(random_block));
  // blinding_dp = random * (p - 1)
  CHECK_MPI_OK(mp_mul(&blinding_dp, &r1, &blinding_dp))if (0 > (err = mp_mul(&blinding_dp, &r1, &blinding_dp
))) goto cleanup;
  //d_p = d_p + random * (p - 1)
  CHECK_MPI_OK(mp_add(&d_p, &blinding_dp, &d_p))if (0 > (err = mp_add(&d_p, &blinding_dp, &d_p
))) goto cleanup;

  // blinding_dq = 1
  CHECK_MPI_OK(mp_set_int(&blinding_dq, 1))if (0 > (err = mp_set_int(&blinding_dq, 1))) goto cleanup;
  // blinding_dq = q - 1
  CHECK_MPI_OK(mp_sub(&q, &blinding_dq, &blinding_dq))if (0 > (err = mp_sub(&q, &blinding_dq, &blinding_dq
))) goto cleanup;
  // generating a random value
  RNG_GenerateGlobalRandomBytes(random_block, EXP_BLINDING_RANDOMNESS_LEN_BYTES(((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit))
) * sizeof(mp_digit)));
  memcpy(MP_DIGITS(&r2)((&r2)->dp), random_block, sizeof(random_block));
  MP_USED(&r2)((&r2)->used) = EXP_BLINDING_RANDOMNESS_LEN((128 + (8 * sizeof(mp_digit)) - 1) / (8 * sizeof(mp_digit)));
  // blinding_dq = random * (q - 1)
  CHECK_MPI_OK(mp_mul(&blinding_dq, &r2, &blinding_dq))if (0 > (err = mp_mul(&blinding_dq, &r2, &blinding_dq
))) goto cleanup;
  //d_q = d_q + random * (q-1)
  CHECK_MPI_OK(mp_add(&d_q, &blinding_dq, &d_q))if (0 > (err = mp_add(&d_q, &blinding_dq, &d_q
))) goto cleanup;

  /* 1. m1 = c**d_p mod p */
  CHECK_MPI_OK(mp_mod(c, &p, &ctmp))if (0 > (err = mp_mod(c, &p, &ctmp))) goto cleanup;
  CHECK_MPI_OK(mp_exptmod(&ctmp, &d_p, &p, &m1))if (0 > (err = mp_exptmod(&ctmp, &d_p, &p, &
m1))) goto cleanup;
  /* 2. m2 = c**d_q mod q */
  CHECK_MPI_OK(mp_mod(c, &q, &ctmp))if (0 > (err = mp_mod(c, &q, &ctmp))) goto cleanup;
  CHECK_MPI_OK(mp_exptmod(&ctmp, &d_q, &q, &m2))if (0 > (err = mp_exptmod(&ctmp, &d_q, &q, &
m2))) goto cleanup;
  /* 3.  h = (m1 - m2) * qInv mod p */
  CHECK_MPI_OK(mp_submod(&m1, &m2, &p, &h))if (0 > (err = mp_submod(&m1, &m2, &p, &h)
)) goto cleanup;
  CHECK_MPI_OK(mp_mulmod(&h, &qInv, &p, &h))if (0 > (err = mp_mulmod(&h, &qInv, &p, &h
))) goto cleanup;
  /* 4.  m = m2 + h * q */
  CHECK_MPI_OK(mp_mul(&h, &q, m))if (0 > (err = mp_mul(&h, &q, m))) goto cleanup;
  CHECK_MPI_OK(mp_add(m, &m2, m))if (0 > (err = mp_add(m, &m2, m))) goto cleanup;
1112cleanup:
  mp_clear(&p);
  mp_clear(&q);
  mp_clear(&d_p);
  mp_clear(&d_q);
  mp_clear(&qInv);
  mp_clear(&m1);
  mp_clear(&m2);
  mp_clear(&h);
  mp_clear(&ctmp);
  mp_clear(&blinding_dp);
  mp_clear(&blinding_dq);
  mp_clear(&r1);
  mp_clear(&r2);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1131}

1133/*
1134** An attack against RSA CRT was described by Boneh, DeMillo, and Lipton in:
1135** "On the Importance of Eliminating Errors in Cryptographic Computations",
1136** http://theory.stanford.edu/~dabo/papers/faults.ps.gz
1137**
1138** As a defense against the attack, carry out the private key operation,
1139** followed up with a public key operation to invert the result.
1140** Verify that result against the input.
1141*/
1142static SECStatus
1143rsa_PrivateKeyOpCRTCheckedPubKey(RSAPrivateKey *key, mp_int *m, mp_int *c)
1144{
  mp_int n, e, v;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&e)((&e)->dp) = 0;
  MP_DIGITS(&v)((&v)->dp) = 0;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  CHECK_MPI_OK(mp_init(&v))if (0 > (err = mp_init(&v))) goto cleanup;
  CHECK_SEC_OK(rsa_PrivateKeyOpCRTNoCheck(key, m, c))if (SECSuccess != (rv = rsa_PrivateKeyOpCRTNoCheck(key, m, c)
)) goto cleanup;
  SECITEM_TO_MPINT(key->modulus, &n)if (0 > (err = mp_read_unsigned_octets((&n), (key->
modulus).data, (key->modulus).len))) goto cleanup;
  SECITEM_TO_MPINT(key->publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (key->
publicExponent).data, (key->publicExponent).len))) goto cleanup;
  /* Perform a public key operation v = m ** e mod n */
  CHECK_MPI_OK(mp_exptmod(m, &e, &n, &v))if (0 > (err = mp_exptmod(m, &e, &n, &v))) goto
 cleanup;
  if (mp_cmp(&v, c) != 0) {
      rv = SECFailure;
  }
1162cleanup:
  mp_clear(&n);
  mp_clear(&e);
  mp_clear(&v);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1171}

1173static PRCallOnceType coBPInit = { 0, 0, 0 };
1174static PRStatus
1175init_blinding_params_list(void)
1176{
  blindingParamsList.lock = PZ_NewLock(nssILockOther)PR_NewLock_stub();
  if (!blindingParamsList.lock) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      return PR_FAILURE;
  }
  blindingParamsList.cVar = PR_NewCondVarPR_NewCondVar_stub(blindingParamsList.lock);
  if (!blindingParamsList.cVar) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      return PR_FAILURE;
  }
  blindingParamsList.waitCount = 0;
  PR_INIT_CLIST(&blindingParamsList.head)do { (&blindingParamsList.head)->next = (&blindingParamsList
.head); (&blindingParamsList.head)->prev = (&blindingParamsList
.head); } while (0);
  return PR_SUCCESS;
1190}

1192static SECStatus
1193generate_blinding_params(RSAPrivateKey *key, mp_int *f, mp_int *g, mp_int *n,
                       unsigned int modLen)
1195{
  SECStatus rv = SECSuccess;
  mp_int e, k;
  mp_err err = MP_OKAY0;
  unsigned char *kb = NULL((void*)0);

  MP_DIGITS(&e)((&e)->dp) = 0;
  MP_DIGITS(&k)((&k)->dp) = 0;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  CHECK_MPI_OK(mp_init(&k))if (0 > (err = mp_init(&k))) goto cleanup;
  SECITEM_TO_MPINT(key->publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (key->
publicExponent).data, (key->publicExponent).len))) goto cleanup;
  /* generate random k < n */
  kb = PORT_AllocPORT_Alloc_stub(modLen);
  if (!kb) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
      goto cleanup;
  }
  CHECK_SEC_OK(RNG_GenerateGlobalRandomBytes(kb, modLen))if (SECSuccess != (rv = RNG_GenerateGlobalRandomBytes(kb, modLen
))) goto cleanup;
  CHECK_MPI_OK(mp_read_unsigned_octets(&k, kb, modLen))if (0 > (err = mp_read_unsigned_octets(&k, kb, modLen)
)) goto cleanup;
  /* k < n */
  CHECK_MPI_OK(mp_mod(&k, n, &k))if (0 > (err = mp_mod(&k, n, &k))) goto cleanup;
  /* f = k**e mod n */
  CHECK_MPI_OK(mp_exptmod(&k, &e, n, f))if (0 > (err = mp_exptmod(&k, &e, n, f))) goto cleanup;
  /* g = k**-1 mod n */
  CHECK_MPI_OK(mp_invmod(&k, n, g))if (0 > (err = mp_invmod(&k, n, g))) goto cleanup;
  /* g in montgomery form.. */
  CHECK_MPI_OK(mp_to_mont(g, n, g))if (0 > (err = mp_to_mont(g, n, g))) goto cleanup;
1222cleanup:
  if (kb)
      PORT_ZFreePORT_ZFree_stub(kb, modLen);
  mp_clear(&k);
  mp_clear(&e);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1232}

1234static SECStatus
1235init_blinding_params(RSABlindingParams *rsabp, RSAPrivateKey *key,
                   mp_int *n, unsigned int modLen)
1237{
  blindingParams *bp = rsabp->array;
  int i = 0;

  /* Initialize the list pointer for the element */
  PR_INIT_CLIST(&rsabp->link)do { (&rsabp->link)->next = (&rsabp->link); (
&rsabp->link)->prev = (&rsabp->link); } while
 (0);
  for (i = 0; i < RSA_BLINDING_PARAMS_MAX_CACHE_SIZE20; ++i, ++bp) {
      bp->next = bp + 1;
      MP_DIGITS(&bp->f)((&bp->f)->dp) = 0;
      MP_DIGITS(&bp->g)((&bp->g)->dp) = 0;
      bp->counter = 0;
  }
  /* The last bp->next value was initialized with out
   * of rsabp->array pointer and must be set to NULL
   */
  rsabp->array[RSA_BLINDING_PARAMS_MAX_CACHE_SIZE20 - 1].next = NULL((void*)0);

  bp = rsabp->array;
  rsabp->bp = NULL((void*)0);
  rsabp->free = bp;

  /* precalculate montgomery reduction parameter */
  rsabp->n0i = mp_calculate_mont_n0i(n);

  /* List elements are keyed using the modulus */
  return SECITEM_CopyItemSECITEM_CopyItem_stub(NULL((void*)0), &rsabp->modulus, &key->modulus);
1263}

1265static SECStatus
1266get_blinding_params(RSAPrivateKey *key, mp_int *n, unsigned int modLen,
                  mp_int *f, mp_int *g, mp_digit *n0i)
1268{
  RSABlindingParams *rsabp = NULL((void*)0);
  blindingParams *bpUnlinked = NULL((void*)0);
  blindingParams *bp;
  PRCList *el;
  SECStatus rv = SECSuccess;
  mp_err err = MP_OKAY0;
  int cmp = -1;
  PRBool holdingLock = PR_FALSE0;

  do {
      if (blindingParamsList.lock == NULL((void*)0)) {
          PORT_SetErrorPORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE);
          return SECFailure;
      }
      /* Acquire the list lock */
      PZ_Lock(blindingParamsList.lock)PR_Lock_stub((blindingParamsList.lock));
      holdingLock = PR_TRUE1;

      /* Walk the list looking for the private key */
      for (el = PR_NEXT_LINK(&blindingParamsList.head)((&blindingParamsList.head)->next);
           el != &blindingParamsList.head;
           el = PR_NEXT_LINK(el)((el)->next)) {
          rsabp = (RSABlindingParams *)el;
          cmp = SECITEM_CompareItemSECITEM_CompareItem_stub(&rsabp->modulus, &key->modulus);
          if (cmp >= 0) {
              /* The key is found or not in the list. */
              break;
          }
      }

      if (cmp) {
          /* At this point, the key is not in the list.  el should point to
          ** the list element before which this key should be inserted.
          */
          rsabp = PORT_ZNew(RSABlindingParams)(RSABlindingParams *)PORT_ZAlloc_stub(sizeof(RSABlindingParams
));
          if (!rsabp) {
              PORT_SetErrorPORT_SetError_stub(SEC_ERROR_NO_MEMORY);
              goto cleanup;
          }

          rv = init_blinding_params(rsabp, key, n, modLen);
          if (rv != SECSuccess) {
              PORT_ZFreePORT_ZFree_stub(rsabp, sizeof(RSABlindingParams));
              goto cleanup;
          }

          /* Insert the new element into the list
          ** If inserting in the middle of the list, el points to the link
          ** to insert before.  Otherwise, the link needs to be appended to
          ** the end of the list, which is the same as inserting before the
          ** head (since el would have looped back to the head).
          */
          PR_INSERT_BEFORE(&rsabp->link, el)do { (&rsabp->link)->next = (el); (&rsabp->link
)->prev = (el)->prev; (el)->prev->next = (&rsabp
->link); (el)->prev = (&rsabp->link); } while (0
);
      }

      /* We've found (or created) the RSAblindingParams struct for this key.
       * Now, search its list of ready blinding params for a usable one.
       */
      *n0i = rsabp->n0i;
      while (0 != (bp = rsabp->bp)) {
1329#ifdef UNSAFE_FUZZER_MODE
          /* Found a match and there are still remaining uses left */
          /* Return the parameters */
          CHECK_MPI_OK(mp_copy(&bp->f, f))if (0 > (err = mp_copy(&bp->f, f))) goto cleanup;
          CHECK_MPI_OK(mp_copy(&bp->g, g))if (0 > (err = mp_copy(&bp->g, g))) goto cleanup;

          PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
          return SECSuccess;
1337#else
          if (--(bp->counter) > 0) {
              /* Found a match and there are still remaining uses left */
              /* Return the parameters */
              CHECK_MPI_OK(mp_copy(&bp->f, f))if (0 > (err = mp_copy(&bp->f, f))) goto cleanup;
              CHECK_MPI_OK(mp_copy(&bp->g, g))if (0 > (err = mp_copy(&bp->g, g))) goto cleanup;

              PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
              return SECSuccess;
          }
          /* exhausted this one, give its values to caller, and
           * then retire it.
           */
          mp_exch(&bp->f, f);
          mp_exch(&bp->g, g);
          mp_clear(&bp->f);
          mp_clear(&bp->g);
          bp->counter = 0;
          /* Move to free list */
          rsabp->bp = bp->next;
          bp->next = rsabp->free;
          rsabp->free = bp;
          /* In case there're threads waiting for new blinding
           * value - notify 1 thread the value is ready
           */
          if (blindingParamsList.waitCount > 0) {
              PR_NotifyCondVarPR_NotifyCondVar_stub(blindingParamsList.cVar);
              blindingParamsList.waitCount--;
          }
          PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
          return SECSuccess;
1368#endif
      }
      /* We did not find a usable set of blinding params.  Can we make one? */
      /* Find a free bp struct. */
      if ((bp = rsabp->free) != NULL((void*)0)) {
          /* unlink this bp */
          rsabp->free = bp->next;
          bp->next = NULL((void*)0);
          bpUnlinked = bp; /* In case we fail */

          PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
          holdingLock = PR_FALSE0;
          /* generate blinding parameter values for the current thread */
          CHECK_SEC_OK(generate_blinding_params(key, f, g, n, modLen))if (SECSuccess != (rv = generate_blinding_params(key, f, g, n
, modLen))) goto cleanup;

          /* put the blinding parameter values into cache */
          CHECK_MPI_OK(mp_init(&bp->f))if (0 > (err = mp_init(&bp->f))) goto cleanup;
          CHECK_MPI_OK(mp_init(&bp->g))if (0 > (err = mp_init(&bp->g))) goto cleanup;
          CHECK_MPI_OK(mp_copy(f, &bp->f))if (0 > (err = mp_copy(f, &bp->f))) goto cleanup;
          CHECK_MPI_OK(mp_copy(g, &bp->g))if (0 > (err = mp_copy(g, &bp->g))) goto cleanup;

          /* Put this at head of queue of usable params. */
          PZ_Lock(blindingParamsList.lock)PR_Lock_stub((blindingParamsList.lock));
          holdingLock = PR_TRUE1;
          (void)holdingLock;
          /* initialize RSABlindingParamsStr */
          bp->counter = RSA_BLINDING_PARAMS_MAX_REUSE50;
          bp->next = rsabp->bp;
          rsabp->bp = bp;
          bpUnlinked = NULL((void*)0);
          /* In case there're threads waiting for new blinding value
           * just notify them the value is ready
           */
          if (blindingParamsList.waitCount > 0) {
              PR_NotifyAllCondVarPR_NotifyAllCondVar_stub(blindingParamsList.cVar);
              blindingParamsList.waitCount = 0;
          }
          PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
          return SECSuccess;
      }
      /* Here, there are no usable blinding parameters available,
       * and no free bp blocks, presumably because they're all
       * actively having parameters generated for them.
       * So, we need to wait here and not eat up CPU until some
       * change happens.
       */
      blindingParamsList.waitCount++;
      PR_WaitCondVarPR_WaitCondVar_stub(blindingParamsList.cVar, PR_INTERVAL_NO_TIMEOUT0xffffffffUL);
      PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
      holdingLock = PR_FALSE0;
      (void)holdingLock;
  } while (1);

1421cleanup:
  /* It is possible to reach this after the lock is already released.  */
  if (bpUnlinked) {
      if (!holdingLock) {
          PZ_Lock(blindingParamsList.lock)PR_Lock_stub((blindingParamsList.lock));
          holdingLock = PR_TRUE1;
      }
      bp = bpUnlinked;
      mp_clear(&bp->f);
      mp_clear(&bp->g);
      bp->counter = 0;
      /* Must put the unlinked bp back on the free list */
      bp->next = rsabp->free;
      rsabp->free = bp;
  }
  if (holdingLock) {
      PZ_Unlock(blindingParamsList.lock)PR_Unlock_stub((blindingParamsList.lock));
  }
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
  }
  *n0i = 0;
  return SECFailure;
1444}

1446/*
1447** Perform a raw private-key operation
1448**  Length of input and output buffers are equal to key's modulus len.
1449*/
1450static SECStatus
1451rsa_PrivateKeyOp(RSAPrivateKey *key,
               unsigned char *output,
               const unsigned char *input,
               PRBool check)
1455{
  unsigned int modLen;
  unsigned int offset;
  SECStatus rv = SECSuccess;
  mp_err err;
  mp_int n, c, m;
  mp_int f, g;
  mp_digit n0i;
2
←
'n0i' declared without an initial value→
  if (!key || !output || !input) {
3
←
Assuming 'key' is non-null→
4
←
Assuming 'output' is non-null→
5
←
Assuming 'input' is non-null→
6
←
Taking false branch→
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }
  /* check input out of range (needs to be in range [0..n-1]) */
  modLen = rsa_modulusLen(&key->modulus);
  if (modLen6.1
'modLen' is not equal to 0
 == 0) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }
  offset = (key->modulus.data[0] == 0) ? 1 : 0; /* may be leading 0 */
7
←
'?' condition is false→
  if (memcmp(input, key->modulus.data + offset, modLen) >= 0) {
8
←
Assuming the condition is false→
9
←
Taking false branch→
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&c)((&c)->dp) = 0;
  MP_DIGITS(&m)((&m)->dp) = 0;
  MP_DIGITS(&f)((&f)->dp) = 0;
  MP_DIGITS(&g)((&g)->dp) = 0;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
10
←
Assuming the condition is false→
11
←
Taking false branch→
  CHECK_MPI_OK(mp_init(&c))if (0 > (err = mp_init(&c))) goto cleanup;
12
←
Assuming the condition is false→
13
←
Taking false branch→
  CHECK_MPI_OK(mp_init(&m))if (0 > (err = mp_init(&m))) goto cleanup;
14
←
Assuming the condition is false→
15
←
Taking false branch→
  CHECK_MPI_OK(mp_init(&f))if (0 > (err = mp_init(&f))) goto cleanup;
16
←
Assuming the condition is false→
17
←
Taking false branch→
  CHECK_MPI_OK(mp_init(&g))if (0 > (err = mp_init(&g))) goto cleanup;
18
←
Assuming the condition is false→
19
←
Taking false branch→
  SECITEM_TO_MPINT(key->modulus, &n)if (0 > (err = mp_read_unsigned_octets((&n), (key->
modulus).data, (key->modulus).len))) goto cleanup;
20
←
Assuming the condition is false→
21
←
Taking false branch→
  OCTETS_TO_MPINT(input, &c, modLen)if (0 > (err = mp_read_unsigned_octets((&c), input, modLen
))) goto cleanup;
22
←
Assuming the condition is false→
23
←
Taking false branch→
  /* If blinding, compute pre-image of ciphertext by multiplying by
  ** blinding factor
  */
  if (nssRSAUseBlinding) {
24
←
Assuming 'nssRSAUseBlinding' is 0→
      CHECK_SEC_OK(get_blinding_params(key, &n, modLen, &f, &g, &n0i))if (SECSuccess != (rv = get_blinding_params(key, &n, modLen
, &f, &g, &n0i))) goto cleanup;
      /* c' = c*f mod n */
      CHECK_MPI_OK(mp_mulmod(&c, &f, &n, &c))if (0 > (err = mp_mulmod(&c, &f, &n, &c)))
 goto cleanup;
  }
  /* Do the private key operation m = c**d mod n */
  if (key->prime1.len == 0 ||
25
←
Assuming field 'len' is equal to 0→
      key->prime2.len == 0 ||
      key->exponent1.len == 0 ||
      key->exponent2.len == 0 ||
      key->coefficient.len == 0) {
      CHECK_SEC_OK(rsa_PrivateKeyOpNoCRT(key, &m, &c, &n, modLen))if (SECSuccess != (rv = rsa_PrivateKeyOpNoCRT(key, &m, &
c, &n, modLen))) goto cleanup;
26
←
Assuming the condition is false→
27
←
Taking false branch→
  } else if (check) {
      CHECK_SEC_OK(rsa_PrivateKeyOpCRTCheckedPubKey(key, &m, &c))if (SECSuccess != (rv = rsa_PrivateKeyOpCRTCheckedPubKey(key,
 &m, &c))) goto cleanup;
  } else {
      CHECK_SEC_OK(rsa_PrivateKeyOpCRTNoCheck(key, &m, &c))if (SECSuccess != (rv = rsa_PrivateKeyOpCRTNoCheck(key, &
m, &c))) goto cleanup;
  }
  /* If blinding, compute post-image of plaintext by multiplying by
  ** blinding factor
  */
  if (nssRSAUseBlinding) {
28
←
Assuming 'nssRSAUseBlinding' is not equal to 0→
29
←
Taking true branch→
      /* m = m'*g mod n */
      CHECK_MPI_OK(mp_mulmontmodCT(&m, &g, &n, n0i, &m))if (0 > (err = mp_mulmontmodCT(&m, &g, &n, n0i
, &m))) goto cleanup;
30
←
4th function call argument is an uninitialized value
  }
  err = mp_to_fixlen_octets(&m, output, modLen);
  if (err >= 0)
      err = MP_OKAY0;
1520cleanup:
  mp_clear(&n);
  mp_clear(&c);
  mp_clear(&m);
  mp_clear(&f);
  mp_clear(&g);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1531}

1533SECStatus
1534RSA_PrivateKeyOp(RSAPrivateKey *key,
               unsigned char *output,
               const unsigned char *input)
1537{
  return rsa_PrivateKeyOp(key, output, input, PR_FALSE0);
1
Calling 'rsa_PrivateKeyOp'→
1539}

1541SECStatus
1542RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey *key,
                            unsigned char *output,
                            const unsigned char *input)
1545{
  return rsa_PrivateKeyOp(key, output, input, PR_TRUE1);
1547}

1549SECStatus
1550RSA_PrivateKeyCheck(const RSAPrivateKey *key)
1551{
  mp_int p, q, n, psub1, qsub1, e, d, d_p, d_q, qInv, res;
  mp_err err = MP_OKAY0;
  SECStatus rv = SECSuccess;
  MP_DIGITS(&p)((&p)->dp) = 0;
  MP_DIGITS(&q)((&q)->dp) = 0;
  MP_DIGITS(&n)((&n)->dp) = 0;
  MP_DIGITS(&psub1)((&psub1)->dp) = 0;
  MP_DIGITS(&qsub1)((&qsub1)->dp) = 0;
  MP_DIGITS(&e)((&e)->dp) = 0;
  MP_DIGITS(&d)((&d)->dp) = 0;
  MP_DIGITS(&d_p)((&d_p)->dp) = 0;
  MP_DIGITS(&d_q)((&d_q)->dp) = 0;
  MP_DIGITS(&qInv)((&qInv)->dp) = 0;
  MP_DIGITS(&res)((&res)->dp) = 0;
  CHECK_MPI_OK(mp_init(&p))if (0 > (err = mp_init(&p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&q))if (0 > (err = mp_init(&q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&n))if (0 > (err = mp_init(&n))) goto cleanup;
  CHECK_MPI_OK(mp_init(&psub1))if (0 > (err = mp_init(&psub1))) goto cleanup;
  CHECK_MPI_OK(mp_init(&qsub1))if (0 > (err = mp_init(&qsub1))) goto cleanup;
  CHECK_MPI_OK(mp_init(&e))if (0 > (err = mp_init(&e))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d))if (0 > (err = mp_init(&d))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d_p))if (0 > (err = mp_init(&d_p))) goto cleanup;
  CHECK_MPI_OK(mp_init(&d_q))if (0 > (err = mp_init(&d_q))) goto cleanup;
  CHECK_MPI_OK(mp_init(&qInv))if (0 > (err = mp_init(&qInv))) goto cleanup;
  CHECK_MPI_OK(mp_init(&res))if (0 > (err = mp_init(&res))) goto cleanup;

  if (!key->modulus.data || !key->prime1.data || !key->prime2.data ||
      !key->publicExponent.data || !key->privateExponent.data ||
      !key->exponent1.data || !key->exponent2.data ||
      !key->coefficient.data) {
      /* call RSA_PopulatePrivateKey first, if the application wishes to
       * recover these parameters */
      err = MP_BADARG-4;
      goto cleanup;
  }

  SECITEM_TO_MPINT(key->modulus, &n)if (0 > (err = mp_read_unsigned_octets((&n), (key->
modulus).data, (key->modulus).len))) goto cleanup;
  SECITEM_TO_MPINT(key->prime1, &p)if (0 > (err = mp_read_unsigned_octets((&p), (key->
prime1).data, (key->prime1).len))) goto cleanup;
  SECITEM_TO_MPINT(key->prime2, &q)if (0 > (err = mp_read_unsigned_octets((&q), (key->
prime2).data, (key->prime2).len))) goto cleanup;
  SECITEM_TO_MPINT(key->publicExponent, &e)if (0 > (err = mp_read_unsigned_octets((&e), (key->
publicExponent).data, (key->publicExponent).len))) goto cleanup;
  SECITEM_TO_MPINT(key->privateExponent, &d)if (0 > (err = mp_read_unsigned_octets((&d), (key->
privateExponent).data, (key->privateExponent).len))) goto cleanup;
  SECITEM_TO_MPINT(key->exponent1, &d_p)if (0 > (err = mp_read_unsigned_octets((&d_p), (key->
exponent1).data, (key->exponent1).len))) goto cleanup;
  SECITEM_TO_MPINT(key->exponent2, &d_q)if (0 > (err = mp_read_unsigned_octets((&d_q), (key->
exponent2).data, (key->exponent2).len))) goto cleanup;
  SECITEM_TO_MPINT(key->coefficient, &qInv)if (0 > (err = mp_read_unsigned_octets((&qInv), (key->
coefficient).data, (key->coefficient).len))) goto cleanup;
  /* p and q must be distinct. */
  if (mp_cmp(&p, &q) == 0) {
      rv = SECFailure;
      goto cleanup;
  }
1601#define VERIFY_MPI_EQUAL(m1, m2)if (mp_cmp(m1, m2) != 0) { rv = SECFailure; goto cleanup; } \
  if (mp_cmp(m1, m2) != 0) {   \
      rv = SECFailure;         \
      goto cleanup;            \
  }
1606#define VERIFY_MPI_EQUAL_1(m)if (mp_cmp_d(m, 1) != 0) { rv = SECFailure; goto cleanup; }  \
  if (mp_cmp_d(m, 1) != 0) { \
      rv = SECFailure;       \
      goto cleanup;          \
  }
  /* n == p * q */
  CHECK_MPI_OK(mp_mul(&p, &q, &res))if (0 > (err = mp_mul(&p, &q, &res))) goto cleanup;
  VERIFY_MPI_EQUAL(&res, &n)if (mp_cmp(&res, &n) != 0) { rv = SECFailure; goto cleanup
; };
  /* gcd(e, p-1) == 1 */
  CHECK_MPI_OK(mp_sub_d(&p, 1, &psub1))if (0 > (err = mp_sub_d(&p, 1, &psub1))) goto cleanup;
  CHECK_MPI_OK(mp_gcd(&e, &psub1, &res))if (0 > (err = mp_gcd(&e, &psub1, &res))) goto
 cleanup;
  VERIFY_MPI_EQUAL_1(&res)if (mp_cmp_d(&res, 1) != 0) { rv = SECFailure; goto cleanup
; };
  /* gcd(e, q-1) == 1 */
  CHECK_MPI_OK(mp_sub_d(&q, 1, &qsub1))if (0 > (err = mp_sub_d(&q, 1, &qsub1))) goto cleanup;
  CHECK_MPI_OK(mp_gcd(&e, &qsub1, &res))if (0 > (err = mp_gcd(&e, &qsub1, &res))) goto
 cleanup;
  VERIFY_MPI_EQUAL_1(&res)if (mp_cmp_d(&res, 1) != 0) { rv = SECFailure; goto cleanup
; };
  /* d*e == 1 mod p-1 */
  CHECK_MPI_OK(mp_mulmod(&d, &e, &psub1, &res))if (0 > (err = mp_mulmod(&d, &e, &psub1, &
res))) goto cleanup;
  VERIFY_MPI_EQUAL_1(&res)if (mp_cmp_d(&res, 1) != 0) { rv = SECFailure; goto cleanup
; };
  /* d*e == 1 mod q-1 */
  CHECK_MPI_OK(mp_mulmod(&d, &e, &qsub1, &res))if (0 > (err = mp_mulmod(&d, &e, &qsub1, &
res))) goto cleanup;
  VERIFY_MPI_EQUAL_1(&res)if (mp_cmp_d(&res, 1) != 0) { rv = SECFailure; goto cleanup
; };
  /* d_p == d mod p-1 */
  CHECK_MPI_OK(mp_mod(&d, &psub1, &res))if (0 > (err = mp_mod(&d, &psub1, &res))) goto
 cleanup;
  VERIFY_MPI_EQUAL(&res, &d_p)if (mp_cmp(&res, &d_p) != 0) { rv = SECFailure; goto cleanup
; };
  /* d_q == d mod q-1 */
  CHECK_MPI_OK(mp_mod(&d, &qsub1, &res))if (0 > (err = mp_mod(&d, &qsub1, &res))) goto
 cleanup;
  VERIFY_MPI_EQUAL(&res, &d_q)if (mp_cmp(&res, &d_q) != 0) { rv = SECFailure; goto cleanup
; };
  /* q * q**-1 == 1 mod p */
  CHECK_MPI_OK(mp_mulmod(&q, &qInv, &p, &res))if (0 > (err = mp_mulmod(&q, &qInv, &p, &res
))) goto cleanup;
  VERIFY_MPI_EQUAL_1(&res)if (mp_cmp_d(&res, 1) != 0) { rv = SECFailure; goto cleanup
; };

1638cleanup:
  mp_clear(&n);
  mp_clear(&p);
  mp_clear(&q);
  mp_clear(&psub1);
  mp_clear(&qsub1);
  mp_clear(&e);
  mp_clear(&d);
  mp_clear(&d_p);
  mp_clear(&d_q);
  mp_clear(&qInv);
  mp_clear(&res);
  if (err) {
      MP_TO_SEC_ERROR(err)switch (err) { case -2: PORT_SetError_stub(SEC_ERROR_NO_MEMORY
); break; case -3: PORT_SetError_stub(SEC_ERROR_BAD_DATA); break
; case -4: PORT_SetError_stub(SEC_ERROR_INVALID_ARGS); break;
 default: PORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE); break
; };
      rv = SECFailure;
  }
  return rv;
1655}

1657SECStatus
1658RSA_Init(void)
1659{
  if (PR_CallOncePR_CallOnce_stub(&coBPInit, init_blinding_params_list) != PR_SUCCESS) {
      PORT_SetErrorPORT_SetError_stub(SEC_ERROR_LIBRARY_FAILURE);
      return SECFailure;
  }
  return SECSuccess;
1665}

1667/* cleanup at shutdown */
1668void
1669RSA_Cleanup(void)
1670{
  blindingParams *bp = NULL((void*)0);
  if (!coBPInit.initialized)
      return;

  while (!PR_CLIST_IS_EMPTY(&blindingParamsList.head)((&blindingParamsList.head)->next == (&blindingParamsList
.head))) {
      RSABlindingParams *rsabp =
          (RSABlindingParams *)PR_LIST_HEAD(&blindingParamsList.head)(&blindingParamsList.head)->next;
      PR_REMOVE_LINK(&rsabp->link)do { (&rsabp->link)->prev->next = (&rsabp->
link)->next; (&rsabp->link)->next->prev = (&
rsabp->link)->prev; } while (0);
      /* clear parameters cache */
      while (rsabp->bp != NULL((void*)0)) {
          bp = rsabp->bp;
          rsabp->bp = rsabp->bp->next;
          mp_clear(&bp->f);
          mp_clear(&bp->g);
      }
      SECITEM_ZfreeItemSECITEM_ZfreeItem_stub(&rsabp->modulus, PR_FALSE0);
      PORT_FreePORT_Free_stub(rsabp);
  }

  if (blindingParamsList.cVar) {
      PR_DestroyCondVarPR_DestroyCondVar_stub(blindingParamsList.cVar);
      blindingParamsList.cVar = NULL((void*)0);
  }

  if (blindingParamsList.lock) {
      SKIP_AFTER_FORK(PZ_DestroyLock(blindingParamsList.lock))if (!bl_parentForkedAfterC_Initialize) PR_DestroyLock_stub((blindingParamsList
.lock));
      blindingParamsList.lock = NULL((void*)0);
  }

  coBPInit.initialized = 0;
  coBPInit.inProgress = 0;
  coBPInit.status = 0;
1703}

1705/*
* need a central place for this function to free up all the memory that
* free_bl may have allocated along the way. Currently only RSA does this,
* so I've put it here for now.
*/
1710void
1711BL_Cleanup(void)
1712{
  RSA_Cleanup();
1714}

1716PRBool bl_parentForkedAfterC_Initialize;

1718/*
* Set fork flag so it can be tested in SKIP_AFTER_FORK on relevant platforms.
*/
1721void
1722BL_SetForkState(PRBool forked)
1723{
  bl_parentForkedAfterC_Initialize = forked;
1725}