• Registered: 2021-03-11
  • Posts: 5

Topic: Questions about error of using encrpyt function with rsa public keys.

Hello, I want to encrypt a character array (32 bytes) using wc_RsaPublicEncrypt function.

At first, I init RNG value using wc_InitRng and init Rsa key using wc_InitRsaKey function. (each function's return value are 0)

and parses a DER-formatted RSA public key (A fixed 550 byte DER-format key is being used), extracts the public key using wc_RsaPublicKeyDecode() function.

After extracting the rsa public key, I want to encrypt the character array data using the wc_RsaPublicEncrypt() function, but a problem occurs here.

wc_RsaPublicEncrypt() function returns -112 (MP_EXPTMOD_E).

Could you please help me to fix the error? Also, if it is a problem with the encoded der-format key, can you tell me how to create a der-format key that can be used in wolfssl?

Share

  • Registered: 2015-10-07
  • Posts: 430

Re: Questions about error of using encrpyt function with rsa public keys.

Hi Kim,

That error usually indicates an issue with the math size. Is this an RSA 4096-bit key? If so you will need to increase the fast math maximum bits. Try `./configure CFLAGS="-DFP_MAX_BITS=8192" or `#define FP_MAX_BITS 8192`. The other possibility is the stack size could be too small. Try increasing the stack size available and try again.

Thanks,
David Garske, wolfSSL

Share

  • Registered: 2021-03-11
  • Posts: 5

Re: Questions about error of using encrpyt function with rsa public keys.

Dear David Garske,

Thank you to your reply. I used a 4096-bit key.

As your suggestion, I modfied the fast math maximum like [#define FP_MAX_BITS 8192], because FP_MAX_BITS value was 4096.

But I still get the same error. So I will try your second suggestion to change the stack size.

I am confused by your words to adjust the stack size, so I ask a question.

What data do you mean by stack? (ex. input size of encryption function or etc..)

Thank you to your support.

Share

  • Registered: 2015-10-07
  • Posts: 430

Re: Questions about error of using encrpyt function with rsa public keys.

Hi Kim,

I am referring to the thread stack size available. Perhaps you can explain the platform and compiler your are running? For RSA 4096-bit you should have at least 32KB stack available and reduce once it is working. For embedded systems you have a few options to reduce the stack. One is WOLFSSL_SMALL_STACK. Another is using a different math option like SP math (sp_int.c) or normal math (integer.c). Once I understand the platform you are on I can provide some further details.

https://www.wolfssl.com/docs/frequently … tions-faq/
https://www.wolfssl.com/wolfssl-smallst … reduction/

Thanks,
David Garske, wolfSSL

Share

  • Registered: 2021-03-11
  • Posts: 5

Re: Questions about error of using encrpyt function with rsa public keys.

Dear David Garske,

I used QNX7 RTOS and ARM 64bit architecture and GNU compiler (gcc) for embeded devolopement.

And I tried define WOLFSSL_SMALL_STACK on header, but still got same error. (-112, MP_EXPTMOD_E)

Thank you for your support

Share

  • Registered: 2015-10-07
  • Posts: 430

Re: Questions about error of using encrpyt function with rsa public keys.

Hi Kim,

Can you share details for how you are building wolfSSL? Are you cross-compiling for QNX using ./configure CC= or using QNX Momentics directly?

It is important that your build settings for the wolfSSL library and your application match. If using ./configure there is a generated wolfssl/options.h file that needs to get included in your application prior to any other wolfSSL headers. If you are building the wolfSSL sources directly configuration is usually done through your own file "user_settings.h" and a pre-processor macro "WOLFSSL_USER_SETTINGS". We have many templates for user_settings.h in examples/configs.

For me building for that target here are some steps I use:

cd ~
source qnx700/qnxsdp-env.sh

# Destination for static library and includes
mkdir wolfssl_build_qnx
export WOLFSSL_BUILD_DIR=`pwd`/wolfssl_build_qnx

git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl

./autogen.sh
./configure --host=aarch64 \
    CC="aarch64-unknown-nto-qnx7.0.0-gcc" \
    AR="aarch64-unknown-nto-qnx7.0.0-ar" \
    RANLIB="aarch64-unknown-nto-qnx7.0.0-ranlib" \
    --prefix=$WOLFSSL_BUILD_DIR \
    --disable-shared --disable-examples --disable-crypttests \
    CFLAGS="-DWOLFSSL_HAVE_MIN -DWOLFSSL_HAVE_MAX \
    -DFP_MAX_BITS=8192" --enable-fastmath \
    --enable-armasm --enable-sp --enable-sp-asm

make
make install

Notes:
•    The "source" sets up environment variables that QNX expects.
•    The configure is used to cross-compile wolfSSL as a static library for QNX.
•    The output is a wolfSSL static library and headers in "wolfssl_build_qnx".
•    The “wolfssl/options.h” is generated by ./configure and must be included prior to any other wolf headers in your application.
•    The “—enable-armasm” option enables the aarch64 assembly speedups.
•    The “--enable-sp” and “--enable-sp-asm” options enable the optimized RSA/DH/ECC math.
•    The FP_MAX_BITS=8192 allows 4096-bit keys.

Thanks,
David Garske, wolfSSL

Share

  • Registered: 2021-03-11
  • Posts: 5

Re: Questions about error of using encrpyt function with rsa public keys.

Dear David,

Thank you to describe.

./configure there is a generated wolfssl/options.h file that needs to get included in your application prior to any other wolfSSL headers.

-> I am testing with the distributed library and header files, so I need to check the build options.
But it will be cross compile. Because options.h is already in headers I used, and already included a option.h prior to other wolfssl headers.

I share to option.h generated to you

#ifndef WOLFSSL_OPTIONS_H
#define WOLFSSL_OPTIONS_H


#ifdef __cplusplus
extern "C" {
#endif

#undef  WOLFSSL_STATIC_RSA
#define WOLFSSL_STATIC_RSA

#undef  WOLFSSL_HAVE_MAX
#define WOLFSSL_HAVE_MAX

#undef  WOLFSSL_HAVE_MIN
#define WOLFSSL_HAVE_MIN

#undef  WOLFSSL_CMAC
#define WOLFSSL_CMAC

#undef  WOLFSSL_STATIC_DH
#define WOLFSSL_STATIC_DH

#undef  IGNORE_KEY_EXTENSIONS
#define IGNORE_KEY_EXTENSIONS

#undef  HAVE_FFDHE_2048
#define HAVE_FFDHE_2048

#undef  WOLFSSL_VERIFY_CB_ALL_CERTS
#define WOLFSSL_VERIFY_CB_ALL_CERTS

#undef  WOLFSSL_EXTRA_ALERTS
#define WOLFSSL_EXTRA_ALERTS

#undef  OPENSSL_EXTRA
#define OPENSSL_EXTRA

#undef  WOLFSSL_ALWAYS_VERIFY_CB
#define WOLFSSL_ALWAYS_VERIFY_CB

#ifndef WOLFSSL_OPTIONS_IGNORE_SYS
#undef  _POSIX_THREADS
#define _POSIX_THREADS
#endif

#undef  HAVE_THREAD_LS
#define HAVE_THREAD_LS

#undef  TFM_TIMING_RESISTANT
#define TFM_TIMING_RESISTANT

#undef  ECC_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT

#undef  WC_RSA_BLINDING
#define WC_RSA_BLINDING

#undef  FORTRESS
#define FORTRESS

#undef  WOLFSSL_ALWAYS_VERIFY_CB
#define WOLFSSL_ALWAYS_VERIFY_CB

#undef  WOLFSSL_AES_COUNTER
#define WOLFSSL_AES_COUNTER

#undef  WOLFSSL_AES_DIRECT
#define WOLFSSL_AES_DIRECT

#undef  WOLFSSL_DER_LOAD
#define WOLFSSL_DER_LOAD

#undef  WOLFSSL_KEY_GEN
#define WOLFSSL_KEY_GEN

#undef  GCM_TABLE
#define GCM_TABLE

#undef  HAVE_AESGCM
#define HAVE_AESGCM

#undef  WOLFSSL_SHA512
#define WOLFSSL_SHA512

#undef  WOLFSSL_SHA384
#define WOLFSSL_SHA384

#undef  WOLFSSL_CERT_GEN
#define WOLFSSL_CERT_GEN

#undef  WOLFSSL_CERT_REQ
#define WOLFSSL_CERT_REQ

#undef  WOLFSSL_CERT_EXT
#define WOLFSSL_CERT_EXT

#undef  HAVE_HKDF
#define HAVE_HKDF

#undef  NO_DSA
#define NO_DSA

#undef  HAVE_ECC
#define HAVE_ECC

#undef  TFM_ECC256
#define TFM_ECC256

#undef  ECC_SHAMIR
#define ECC_SHAMIR

#undef  HAVE_ECC_ENCRYPT
#define HAVE_ECC_ENCRYPT

#undef  NO_RC4
#define NO_RC4

#undef  WOLFSSL_CMAC
#define WOLFSSL_CMAC

#undef  WOLFSSL_AES_DIRECT
#define WOLFSSL_AES_DIRECT

#undef  NO_HC128
#define NO_HC128

#undef  NO_RABBIT
#define NO_RABBIT

#undef  WOLFSSL_DES_ECB
#define WOLFSSL_DES_ECB

#undef  WOLFSSL_SHA224
#define WOLFSSL_SHA224

#undef  WOLFSSL_SHA3
#define WOLFSSL_SHA3

#undef  HAVE_POLY1305
#define HAVE_POLY1305

#undef  HAVE_ONE_TIME_AUTH
#define HAVE_ONE_TIME_AUTH

#undef  HAVE_CHACHA
#define HAVE_CHACHA

#undef  HAVE_HASHDRBG
#define HAVE_HASHDRBG

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES

#undef  HAVE_EXTENDED_MASTER
#define HAVE_EXTENDED_MASTER

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SNI
#define HAVE_SNI

#undef  HAVE_MAX_FRAGMENT
#define HAVE_MAX_FRAGMENT

#undef  HAVE_TRUNCATED_HMAC
#define HAVE_TRUNCATED_HMAC

#undef  HAVE_ALPN
#define HAVE_ALPN

#undef  HAVE_TRUSTED_CA
#define HAVE_TRUSTED_CA

#undef  HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES

#undef  NO_PSK
#define NO_PSK

#undef  NO_MD4
#define NO_MD4

#undef  WOLFSSL_ENCRYPTED_KEYS
#define WOLFSSL_ENCRYPTED_KEYS

#undef  USE_FAST_MATH
#define USE_FAST_MATH

#undef  WC_NO_ASYNC_THREADING
#define WC_NO_ASYNC_THREADING

#undef  NO_DES3
#define NO_DES3

#undef  HAVE___UINT128_T
#define HAVE___UINT128_T 1


#ifdef __cplusplus
}
#endif


#endif /* WOLFSSL_OPTIONS_H */

Share

  • Registered: 2015-10-07
  • Posts: 430

Re: Questions about error of using encrpyt function with rsa public keys.

Hi Kim,

I don't see `#define FP_MAX_BITS 8192`? Also consider having DH 4096-bit support by adding `#define HAVE_FFDHE_4096`.

For manually adding build options with ./configure use the syntax:
`./configure CFLAGS="-DFP_MAX_BITS=8192 -DHAVE_FFDHE_4096"`
Of course adding your "--enable-[options]" to this as well.

Thanks,
David Garske, wolfSSL

Share

  • Registered: 2021-03-11
  • Posts: 5

Re: Questions about error of using encrpyt function with rsa public keys.

Dear David,

I'm including headers like below. But it still got a same error.

#define FP_MAX_BITS 8192
#define HAVE_FFDHE_4096
#define WOLFSSL_SMALL_STACK

#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/ssl.h>
#include <wolfssl/wolfcrypt/integer.h>
#include <wolfssl/wolfcrypt/random.h>
#include <wolfssl/wolfcrypt/rsa.h>
#include <wolfssl/wolfcrypt/aes.h>
#include <wolfssl/error-ssl.h>

Share

  • Registered: 2015-10-07
  • Posts: 430

Re: Questions about error of using encrpyt function with rsa public keys.

Hi Kim,

You cannot fix this issue by adding build macros above the options.h in your application. You must compile the wolfSSL library with these settings otherwise the wolfSSL code will not be updated to support 4096-bit keys.

If you use the instructions above for adding CFLAGS to your ./configure it will build the library with these settings and also include them in your options.h.

Perhaps you should send an inquiry to our support@wolfssl.com referencing this forum post for some additional guidance?

Thanks,
David Garske, wolfSSL

Share