LIBRESSL-RSA_PADDING_ADD_PKCS1_TYPE_1(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🌸 NAME 🌸

okay bestie, welcome to the RSA_PADDING_ADD_PKCS1_TYPE_1(3) page from the LibreSSL Library Functions Manual ✨ — this one is all about asymmetric encryption padding 💖

meet the whole squad:

  • RSA_padding_add_PKCS1_type_1
  • RSA_padding_check_PKCS1_type_1
  • RSA_padding_add_PKCS1_type_2
  • RSA_padding_check_PKCS1_type_2
  • RSA_padding_add_PKCS1_OAEP
  • RSA_padding_check_PKCS1_OAEP
  • RSA_padding_add_none
  • RSA_padding_check_none

✨ SYNOPSIS ✨

library “libcrypto” #include <openssl/rsa.h>

int
RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen,
    unsigned char *f, int fl);

int
RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
    unsigned char *f, int fl, int rsa_len);

int
RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen,
    unsigned char *f, int fl);

int
RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
    unsigned char *f, int fl, int rsa_len);

int
RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
    unsigned char *f, int fl, unsigned char *p, int pl);

int
RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
    unsigned char *f, int fl, int rsa_len, unsigned char *p, int pl);

int
RSA_padding_add_none(unsigned char *to, int tlen, unsigned char *f,
    int fl);

int
RSA_padding_check_none(unsigned char *to, int tlen, unsigned char *f,
    int fl, int rsa_len);

🦋 DESCRIPTION 🦋

so these functions get called from the RSA encrypt, decrypt, sign, and verify functions 👑 normally you should not be calling them from application programs, bestie — they're backstage crew, not main character energy.

however 💅 they can also be called directly to implement padding for other asymmetric ciphers. and listen: RSA_padding_add_PKCS1_OAEP() and RSA_padding_check_PKCS1_OAEP() may be used in an application combined with RSA_NO_PADDING in order to implement OAEP with an encoding parameter. iykyk ✨

the RSA_padding_add_*() functions encode fl bytes from f so as to fit into tlen bytes and store the result at to. an error occurs if fl does not meet the size requirements of the encoding method 😭

the following encoding methods are implemented:

  • PKCS1_type_1 — PKCS #1 v2.0 EMSA-PKCS1-v1_5 (PKCS #1 v1.5 block type 1); used for signatures 🖊️
  • PKCS1_type_2 — PKCS #1 v2.0 EME-PKCS1-v1_5 (PKCS #1 v1.5 block type 2) 📦
  • PKCS1_OAEP — PKCS #1 v2.0 EME-OAEP 🌈
  • none — simply copy the data 🫶

the RSA_padding_check_*() functions verify that the fl bytes at f contain a valid encoding for a rsa_len byte RSA key in the respective encoding method 😌 and they store the recovered data of at most tlen bytes (for RSA_NO_PADDING: of size tlen) at to.

for RSA_padding_*_OAEP(), p points to the encoding parameter of length pl. p may be NULL if pl is 0 💖

💀 RETURN VALUES 💀

the RSA_padding_add_*() functions return 1 on success or 0 on error 🌟

the RSA_padding_check_*() functions return the length of the recovered data or -1 on error 😭

error codes can be obtained by calling ERR_get_error(3) 🔍

🎀 SEE ALSO 🎀

👑 HISTORY 👑

RSA_padding_add_PKCS1_type_1(), RSA_padding_check_PKCS1_type_1(), RSA_padding_add_PKCS1_type_2(), RSA_padding_check_PKCS1_type_2(), RSA_padding_add_none(), and RSA_padding_check_none() first appeared in SSLeay 0.9.0 and have been available since OpenBSD 2.4 🧚

RSA_padding_add_PKCS1_OAEP() and RSA_padding_check_PKCS1_OAEP() first appeared in OpenSSL 0.9.2b and have been available since OpenBSD 2.6 🌸

🙈 BUGS 🙈

bestie, important: the RSA_padding_check_PKCS1_type_2() padding check leaks timing information which can potentially be used to mount a Bleichenbacher padding oracle attack 💀 this is an inherent weakness in the PKCS #1 v1.5 padding design. prefer PKCS1_OAEP padding. fr fr 🫶

💌 okay that's the whole page — Debian, June 8, 2025, RSA_PADDING_ADD_PKCS1_TYPE_1(3). mwah 💋

📦 where this page comes from