pkcs1v15: retrofit deterministic implicit rejection for decryption

CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Changed
+
+- PKCS#1 v1.5 decryption now uses deterministic implicit rejection for
+  padding-invalid ciphertexts while preserving `Err` for publicly invalid
+  ciphertexts and non-padding failures.
+- SHA-256 is now an unconditional internal dependency for PKCS#1 v1.5 implicit
+  rejection. The public `sha2` feature remains for compatibility and continues
+  to gate the SHA-2 reexport and PKCS#1 v1.5 signature OID impls.
+
 ## 0.9.8 (2025-03-12)
 ### Added
 - Doc comments to specify the `rand` version ([#473])

Cargo.toml

@@ -18,7 +18,9 @@ const-oid = { version = "0.10", default-features = false }
 crypto-bigint = { version = "0.7", default-features = false, features = ["zeroize", "alloc"] }
 crypto-primes = { version = "0.7", default-features = false }
 digest = { version = "0.11", default-features = false, features = ["alloc", "oid"] }
+hmac = { version = "0.13", default-features = false }
 rand_core = { version = "0.10", default-features = false }
+sha2 = { version = "0.11", default-features = false, features = ["oid"] }
 signature = { version = "3.0.0-rc.10", default-features = false, features = ["alloc", "digest", "rand_core"] }
 zeroize = { version = "1.8", features = ["alloc"] }
 
@@ -28,7 +30,6 @@ pkcs1 = { version = "0.8.0-rc.4", optional = true, default-features = false, fea
 pkcs8 = { version = "0.11.0-rc.10", optional = true, default-features = false, features = ["alloc", "pem"] }
 serdect = { version = "0.4", optional = true }
 sha1 = { version = "0.11", optional = true, default-features = false, features = ["oid"] }
-sha2 = { version = "0.11", optional = true, default-features = false, features = ["oid"] }
 spki = { version = "0.8", optional = true, default-features = false, features = ["alloc"] }
 serde = { version = "1.0.184", optional = true, default-features = false, features = ["derive"] }
 
@@ -59,6 +60,7 @@ hazmat = []
 getrandom = ["crypto-bigint/getrandom", "crypto-common"]
 serde = ["encoding", "dep:serde", "dep:serdect", "crypto-bigint/serde"]
 pkcs5 = ["pkcs8/encryption"]
+sha2 = []
 
 [package.metadata.docs.rs]
 features = ["std", "serde", "hazmat", "sha2"]

_typos.toml

@@ -0,0 +1,2 @@
+[files]
+extend-exclude = ["tests/examples/pkcs1v15_ir/cases.json"]

src/algorithms/pad.rs

@@ -18,6 +18,24 @@ fn left_pad(input: &[u8], padded_len: usize) -> Result<Vec<u8>> {
     Ok(out)
 }
 
+/// Converts input to an exact modulus-width big-endian encoding.
+///
+/// This normalizes only by the public storage width of the integer: if the
+/// backing representation is wider than `k`, only the public over-width prefix
+/// is dropped. The returned buffer is always exactly `k` octets long.
+#[inline]
+pub(crate) fn i2osp_modulus_width(input: &BoxedUint, k: usize) -> Zeroizing<Vec<u8>> {
+    let bytes = Zeroizing::new(input.to_be_bytes());
+    let copy_len = bytes.len().min(k);
+    let src_start = bytes.len().saturating_sub(k);
+
+    debug_assert!(bytes[..src_start].iter().all(|&byte| byte == 0));
+
+    let mut out = Zeroizing::new(vec![0u8; k]);
+    out[k - copy_len..].copy_from_slice(&bytes[src_start..]);
+    out
+}
+
 /// Converts input to the new vector of the given length, using BE and with 0s left padded.
 /// In some cases BoxedUint might already have leading zeroes, this function removes them
 /// before padding again.
@@ -60,4 +78,29 @@ mod tests {
         let padded = left_pad(&input, INPUT_LEN - 1);
         assert!(padded.is_err());
     }
+
+    #[test]
+    fn test_i2osp_modulus_width_exact_width() {
+        let input = BoxedUint::from_be_slice(&[0x12, 0x34], 128).unwrap();
+        let padded = i2osp_modulus_width(&input, 2);
+
+        assert_eq!(padded.as_slice(), &[0x12, 0x34]);
+    }
+
+    #[test]
+    fn test_i2osp_modulus_width_left_pads_to_modulus_width() {
+        let input = BoxedUint::from_be_slice(&[0x12, 0x34], 128).unwrap();
+        let padded = i2osp_modulus_width(&input, 4);
+
+        assert_eq!(padded.as_slice(), &[0x00, 0x00, 0x12, 0x34]);
+    }
+
+    #[test]
+    fn test_i2osp_modulus_width_odd_modulus_width() {
+        let input = BoxedUint::from_be_slice(&[0x01], 2049).unwrap();
+        let padded = i2osp_modulus_width(&input, 257);
+
+        assert_eq!(padded.len(), 257);
+        assert_eq!(padded[256], 0x01);
+    }
 }