Struct PublicKey 

pub struct PublicKey { /* private fields */ }

An RSA public key parsed from a PKCS#1 SubjectPublicKeyInfo DER blob.

Implementations

impl PublicKey

pub fn from_n_e(n_bytes: &[u8], e: &[u8]) -> Result<Self, RsaError>

Build an RSA public key from raw modulus n and public exponent e (both big-endian byte slices).

This is useful when importing keys from formats like JWK where n and e are available directly as bytes rather than inside an ASN.1 DER wrapper.

The parameters are validated before the key is accepted: n must be odd and between 2048 and 8192 bits, and e must be odd, at least 3, at most 64 bits, and strictly smaller than n. The 64-bit exponent bound keeps verification cost independent of attacker-controlled key parameters (each extra exponent bit costs one modular multiplication).

Errors

Returns RsaError::InvalidKey if n or e fail the checks above (including empty or even n, e < 3, even e, e >= n, or e wider than 64 bits), and RsaError::NotSupported if the modulus exceeds 8192 bits.

pub fn from_pkcs1_der(data: &[u8]) -> Result<Self, RsaError>

Parse an RSA public key from the raw PKCS#1 bytes.

The input is the content of the BIT STRING inside the SPKI — a strict DER SEQUENCE { INTEGER n, INTEGER e }. Non-minimal length encodings, negative or non-minimally-encoded INTEGERs, an oversized outer SEQUENCE, and any trailing bytes inside or after the SEQUENCE are rejected.

The same parameter validation as PublicKey::from_n_e is applied.

Errors

Returns RsaError::Unspecified if data is not the exact strict DER encoding of SEQUENCE { INTEGER n, INTEGER e }, and RsaError::InvalidKey or RsaError::NotSupported when the modulus/exponent fail the PublicKey::from_n_e checks.

pub fn verify_pkcs1_v1_5( &self, signature: &[u8], message_digest: &[u8], digest_info_prefix: &[u8], ) -> Result<(), RsaError>

Verify a PKCS#1 v1.5 signature.

signature is the raw signature bytes (eg., 256 bytes for RSA-2048). message_digest is the hash of the message to verify. digest_info_prefix is the ASN.1 DigestInfo prefix for the hash algorithm (the constant-length portion before the hash value).

The padding and DigestInfo encoding must be strict DER and the DigestInfo must fill the modulus exactly (EM = 00 01 PS 00 T, RFC 8017 §9.2). Non-canonical encodings, including trailing zero bytes after the DigestInfo, are rejected.

Errors

Returns RsaError::Unspecified if signature is not exactly n_len bytes long, if the signature is not reduced modulo n, or if the padded message does not match the canonical encoding for digest_info_prefix and message_digest.

pub fn verify_pss<H: Hasher>( &self, signature: &[u8], message: &[u8], salt_len: usize, ) -> Result<(), RsaError>

Verify an RSA-PSS signature (RFC 8017 §9.1.2).

message is hashed with H, whose digest length must equal salt_len (Go’s PSSSaltLengthEqualsHash).

Per RFC 8017, the encoded-message bit length is emBits = bitlen(n) - 1 and emLen = ceil(emBits / 8). This matters for moduli whose top bit is not set: emLen can be one byte shorter than the modulus and the number of leftmost bits cleared from DB is 8·emLen - emBits, not always 1.

pub fn verify_pkcs1_sha256( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA PKCS#1 v1.5 signature over message using SHA-256.

The message is hashed internally, so callers do not need to hash it themselves. Equivalent to hashing with Sha256 and calling Self::verify_pkcs1_v1_5.

pub fn verify_pkcs1_sha384( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA PKCS#1 v1.5 signature over message using SHA-384.

See Self::verify_pkcs1_sha256 for the hashing contract.

pub fn verify_pkcs1_sha512( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA PKCS#1 v1.5 signature over message using SHA-512.

See Self::verify_pkcs1_sha256 for the hashing contract.

pub fn verify_pss_sha256( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA-PSS signature over message using SHA-256.

The message is hashed internally. The salt length is the hash length (PSSSaltLengthEqualsHash, RFC 8017).

pub fn verify_pss_sha384( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA-PSS signature over message using SHA-384.

See Self::verify_pss_sha256 for the salt-length contract.

pub fn verify_pss_sha512( &self, signature: &[u8], message: &[u8], ) -> Result<(), RsaError>

Verify an RSA-PSS signature over message using SHA-512.

See Self::verify_pss_sha256 for the salt-length contract.

pub fn modulus_len_bytes(&self) -> usize

Number of bytes in the modulus n, trimmed of leading zeros (256 for RSA-2048, 512 for RSA-4096, 1024 for RSA-8192).

pub fn n_bytes(&self) -> Vec<u8>

Returns the modulus n as big-endian bytes, trimmed to the actual key size. (e.g. 256 bytes for RSA-2048, 512 bytes for RSA-4096, 1024 bytes for RSA-8192).

pub fn e_bytes(&self) -> SmallVec<u8, 4>

Returns the public exponent e as big-endian bytes, trimmed of leading zeros. (e.g. [1, 0, 1] for 65537).