This produce a standard PKCS1.5 padding for encryption

Produce a standard PKCS1.5 padding for signature

Try to remove a standard PKCS1.5 encryption padding.

The block is scanned in full rather than up to the octet ending the padding string, so how long that string is does not show up in how long this takes.

What remains visible is the result itself: whether the padding was well formed, and the length of the message when it was. That is inherent to the scheme, and it is the signal Bleichenbacher's attack needs, so a caller that decrypts attacker-supplied ciphertext must not pass the distinction on -- TLS, for instance, continues with a random premaster secret and reports nothing.

decrypt message using the private key.

The blinder is optional and Nothing is accepted, but see Blinder for what it covers and when leaving it out is a decision rather than a default. decryptSafer generates one for you.

The message is returned un-padded.

Following RFC 8017, the ciphertext is rejected unless it is exactly as long as the modulus (section 7.2.2, step 1) and its integer representative is below the modulus (RSADP, section 5.1.2, step 1). The decryption primitive normalises any multiple of the modulus away, so without the second check c + n would decrypt to the same message as c, and a ciphertext would not be unique to its plaintext. Both checks are made on the ciphertext alone, which is public, and report MessageSizeIncorrect.

decrypt message using the private key, blinded with the pair kept for this key; see Crypto.PubKey.RSA.Blinded.

sign message using private key, a hash and its ASN1 description

Deprecated. Use signDigest, or signDigestInfo where this would have been given Nothing. The Maybe hashAlg argument says both "hash it with this" and "do not hash it", and down the first path the value inside the Just is never read: it is there to fix the type, which leaves a caller that has only a type with nothing to pass.

The blinder is optional and Nothing is accepted, but see Blinder for what it covers and when leaving it out is a decision rather than a default. signSafer generates one for you.

sign message using the private key, blinded with the pair kept for this key; see Crypto.PubKey.RSA.Blinded.

Deprecated. Use signSaferDigest, or signSaferDigestInfo.

Sign a digest.

The digest's type says which algorithm made it, so this needs nothing else to name one: the ASN.1 DigestInfo prefix comes from the HashAlgorithmASN1 instance that type selects. sign takes Maybe hashAlg and never reads the value inside the Just -- it is there only to fix the type -- which is no burden when the caller has a value and leaves nothing to pass when the caller is itself polymorphic in the algorithm.

signDigest blinder key (hashWith SHA256 message)

The blinder is optional and Nothing is accepted, but see Blinder for what it covers and when leaving it out is a decision rather than a default. signSaferDigest generates one for you.

signDigest blinded with the pair kept for this key, as signSafer is to sign; see Crypto.PubKey.RSA.Blinded.

Sign something that is already a DigestInfo, the ASN.1 structure naming a hash algorithm and carrying a digest under it.

This is what sign blinder Nothing does. It needs no HashAlgorithmASN1 constraint, because nothing here hashes or encodes: the caller has done both. sign blinder Nothing carries the constraint anyway, and since the type variable then appears nowhere else the caller has to name an algorithm that is never used -- sign blinder (Nothing :: Maybe SHA256) -- to say which one it is not using.

signDigestInfo blinded with the pair kept for this key.

decrypt with the blinding a BlindedKey keeps, and the key for the next operation.

signDigest with the blinding a BlindedKey keeps, and the key for the next operation.

signDigestInfo with the blinding a BlindedKey keeps, and the key for the next operation.

encrypt a bytestring using the public key.

The message needs to be smaller than the key size - 11. The message should not be padded.

verify message with the signed message

Deprecated. Use verifyDigest, or verifyDigestInfo where this would have been given Nothing.

Following RFC 8017, the signature is rejected unless it is exactly as long as the modulus (section 8.2.2, step 1) and its integer representative is below the modulus (section 5.2.2, step 1). Verification works by re-encoding the expected signature and comparing it with the result of the public-key operation, and that operation normalises away both the length of the encoding and any multiple of the modulus; without these checks a zero-padded signature, or s + n, would verify just as well as s.

Verify a signature over a digest. The checks are verifys.

Verify a signature over something that is already a DigestInfo, which is what verify Nothing does.

A specialized class for hash algorithm that can product a ASN1 wrapped description the algorithm plus the content of the digest.