extras: Add APIs for RSA Blind Signatures

Sources/CCryptoBoringSSLShims/include/CCryptoBoringSSLShims.h

@@ -101,6 +101,8 @@ BIGNUM *CCryptoBoringSSLShims_BN_bin2bn(const void *in, size_t len, BIGNUM *ret)
 
 size_t CCryptoBoringSSLShims_BN_bn2bin(const BIGNUM *in, void *out);
 
+int CCryptoBoringSSLShims_BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx);
+
 int CCryptoBoringSSLShims_RSA_verify(int hash_nid, const void *msg, size_t msg_len,
                                      const void *sig, size_t sig_len, RSA *rsa);
 

Sources/CCryptoBoringSSLShims/shims.c

@@ -118,6 +118,10 @@ size_t CCryptoBoringSSLShims_BN_bn2bin(const BIGNUM *in, void *out) {
     return CCryptoBoringSSL_BN_bn2bin(in, out);
 }
 
+int CCryptoBoringSSLShims_BN_mod(BIGNUM *rem, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx) {
+    return BN_mod(rem, a, m, ctx);
+}
+
 int CCryptoBoringSSLShims_RSA_verify(int hash_nid, const void *msg, size_t msg_len,
                                      const void *sig, size_t sig_len, RSA *rsa) {
     return CCryptoBoringSSL_RSA_verify(hash_nid, msg, msg_len, sig, sig_len, rsa);

Sources/CryptoBoringWrapper/ArbitraryPrecisionInteger.swift

@@ -98,6 +98,14 @@ extension ArbitraryPrecisionInteger {
     public init<Bytes: ContiguousBytes>(bytes: Bytes) throws {
         self._backing = try BackingStorage(bytes: bytes)
     }
+
+    /// Create an `ArbitraryPrecisionInteger` from a hex string.
+    ///
+    /// - Parameter hexString: Hex byte string (big-endian, no `0x` prefix, may start with `-` for a negative number).
+    @inlinable
+    public init(hexString: String) throws {
+        self._backing = try BackingStorage(hexString: hexString)
+    }
 }
 
 extension ArbitraryPrecisionInteger.BackingStorage {
@@ -112,8 +120,27 @@ extension ArbitraryPrecisionInteger.BackingStorage {
             throw CryptoBoringWrapperError.internalBoringSSLError()
         }
     }
+
+    @inlinable
+    convenience init(hexString: String) throws {
+        self.init()
+        try hexString.withCString { hexStringPtr in
+            /// `BN_hex2bin` takes a `BIGNUM **` so we need a double WUMP dance.
+            try withUnsafeMutablePointer(to: &self._backing) { backingPtr in
+                var backingPtr: UnsafeMutablePointer<BIGNUM>? = backingPtr
+                try withUnsafeMutablePointer(to: &backingPtr) { backingPtrPtr in
+                    /// `BN_hex2bin` returns the number of bytes of `in` processed or zero on error.
+                    guard CCryptoBoringSSL_BN_hex2bn(backingPtrPtr, hexStringPtr) == hexString.count else {
+                        throw CryptoBoringWrapperError.incorrectParameterSize
+                    }
+                }
+            }
+        }
+    }
 }
 
+
+
 // MARK: - Pointer helpers
 
 extension ArbitraryPrecisionInteger {
@@ -381,6 +408,49 @@ extension ArbitraryPrecisionInteger: SignedNumeric {
     }
 }
 
+// MARK: - Other arithmetic operations
+
+extension ArbitraryPrecisionInteger {
+    @inlinable
+    public static func gcd(_ a: ArbitraryPrecisionInteger, _ b: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        var result = ArbitraryPrecisionInteger()
+
+        guard result.withUnsafeMutableBignumPointer({ resultPtr in
+            a.withUnsafeBignumPointer { aPtr in
+                b.withUnsafeBignumPointer { bPtr in
+                    ArbitraryPrecisionInteger.withUnsafeBN_CTX { bnCtx in
+                        CCryptoBoringSSL_BN_gcd(resultPtr, aPtr, bPtr, bnCtx)
+                    }
+                }
+            }
+        }) == 1 else {
+            throw CryptoBoringWrapperError.internalBoringSSLError()
+        }
+
+        return result
+    }
+
+    @inlinable
+    public func isCoprime(with other: ArbitraryPrecisionInteger) throws -> Bool {
+        try Self.gcd(self, other) == 1
+    }
+
+    @inlinable
+    public static func random(inclusiveMin: UInt64, exclusiveMax: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        var result = ArbitraryPrecisionInteger()
+
+        guard result.withUnsafeMutableBignumPointer({ resultPtr in
+            exclusiveMax.withUnsafeBignumPointer { exclusiveMaxPtr in
+                CCryptoBoringSSL_BN_rand_range_ex(resultPtr, inclusiveMin, exclusiveMaxPtr)
+            }
+        }) == 1 else {
+            throw CryptoBoringWrapperError.internalBoringSSLError()
+        }
+
+        return result
+    }
+}
+
 // MARK: - Serializing
 
 extension Data {
@@ -408,6 +478,12 @@ extension Data {
 
         assert(written == byteCount)
     }
+
+    @inlinable
+    public init(bytesOf integer: ArbitraryPrecisionInteger, paddedToSize paddingSize: Int) throws {
+        self.init(capacity: paddingSize)
+        try self.append(bytesOf: integer, paddedToSize: paddingSize)
+    }
 }
 
 // MARK: - Printing

Sources/CryptoBoringWrapper/FiniteFieldArithmeticContext.swift

@@ -48,6 +48,24 @@ public final class FiniteFieldArithmeticContext {
 // MARK: - Arithmetic operations
 
 extension FiniteFieldArithmeticContext {
+    @inlinable
+    public func residue(_ x: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        var result = ArbitraryPrecisionInteger()
+
+        guard x.withUnsafeBignumPointer({ xPtr in
+            self.fieldSize.withUnsafeBignumPointer { modPtr in
+                result.withUnsafeMutableBignumPointer { resultPtr in
+                    CCryptoBoringSSL_BN_nnmod(resultPtr, xPtr, modPtr, self.bnCtx)
+                }
+            }
+        }) == 1 else {
+            throw CryptoBoringWrapperError.internalBoringSSLError()
+        }
+
+        return result
+
+    }
+
     @inlinable
     public func square(_ input: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
         var output = ArbitraryPrecisionInteger()
@@ -151,4 +169,78 @@ extension FiniteFieldArithmeticContext {
 
         return try ArbitraryPrecisionInteger(copying: actualOutputPointer)
     }
+
+    @inlinable
+    public func inverse(_ x: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger? {
+        var result = ArbitraryPrecisionInteger()
+
+        guard result.withUnsafeMutableBignumPointer({ resultPtr in
+            x.withUnsafeBignumPointer { xPtr in
+                self.fieldSize.withUnsafeBignumPointer { modPtr in
+                    CCryptoBoringSSL_BN_mod_inverse(resultPtr, xPtr , modPtr, self.bnCtx)
+                }
+            }
+        }) != nil else { return nil }
+
+        return result
+    }
+
+    @inlinable
+    public func pow(_ x: ArbitraryPrecisionInteger, _ p: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        try self.pow(x, p) { r, x, p, m, ctx, _ in CCryptoBoringSSL_BN_mod_exp(r, x, p, m, ctx) }
+    }
+
+    @inlinable
+    public func pow(secret x: ArbitraryPrecisionInteger, _ p: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        guard x < self.fieldSize else { throw CryptoBoringWrapperError.incorrectParameterSize }
+        return try self.pow(x, p, using: CCryptoBoringSSL_BN_mod_exp_mont)
+    }
+
+    @inlinable
+    public func pow(secret x: ArbitraryPrecisionInteger, secret p: ArbitraryPrecisionInteger) throws -> ArbitraryPrecisionInteger {
+        guard x < self.fieldSize else { throw CryptoBoringWrapperError.incorrectParameterSize }
+        return try self.pow(x, p, using: CCryptoBoringSSL_BN_mod_exp_mont_consttime)
+    }
+
+    /* private but @usableFromInline */ @usableFromInline func pow(
+        _ a: ArbitraryPrecisionInteger,
+        _ b: ArbitraryPrecisionInteger,
+        using method: (
+            _ rr: UnsafeMutablePointer<BIGNUM>?,
+            _ a: UnsafePointer<BIGNUM>?,
+            _ p: UnsafePointer<BIGNUM>?,
+            _ m: UnsafePointer<BIGNUM>?,
+            _ ctx: OpaquePointer?,
+            _ mont: UnsafePointer<BN_MONT_CTX>?
+        ) -> Int32
+    ) throws -> ArbitraryPrecisionInteger {
+        var result = ArbitraryPrecisionInteger()
+
+        guard result.withUnsafeMutableBignumPointer({ resultPtr in
+            a.withUnsafeBignumPointer { aPtr in
+                b.withUnsafeBignumPointer { bPtr in
+                    self.fieldSize.withUnsafeBignumPointer { modPtr in
+                        self.withUnsafeBN_MONT_CTX { montCtxPtr in
+                            method(resultPtr, aPtr, bPtr, modPtr, self.bnCtx, montCtxPtr)
+                        }
+                    }
+                }
+            }
+        }) == 1 else {
+            throw CryptoBoringWrapperError.internalBoringSSLError()
+        }
+
+        return result
+    }
+
+    /// Some functions require a `BN_MONT_CTX` parameter: this obtains one for the field modulus with a scoped lifetime.
+    /* private but @usableFromInline */ @usableFromInline func withUnsafeBN_MONT_CTX<T>(_ body: (UnsafePointer<BN_MONT_CTX>) throws -> T) rethrows -> T {
+        try self.fieldSize.withUnsafeBignumPointer { modPtr in
+            // We force unwrap here because this call can only fail if the allocator is broken, and if
+            // the allocator fails we don't have long to live anyway.
+            let montCtx = CCryptoBoringSSL_BN_MONT_CTX_new_for_modulus(modPtr, self.bnCtx)!
+            defer { CCryptoBoringSSL_BN_MONT_CTX_free(montCtx) }
+            return try body(montCtx)
+        }
+    }
 }

Sources/_CryptoExtras/CMakeLists.txt

@@ -15,6 +15,7 @@
 add_library(_CryptoExtras
   "ChaCha20CTR/BoringSSL/ChaCha20CTR_boring.swift"
   "ChaCha20CTR/ChaCha20CTR.swift"
+  "RSA/RSA+BlindSigning.swift"
   "RSA/RSA.swift"
   "RSA/RSA_boring.swift"
   "RSA/RSA_security.swift"