LTC sync RSA new style

20 files changed, 391 insertions, 181 deletions

diff --git a/inc/CryptX_PK_RSA.xs.inc b/inc/CryptX_PK_RSA.xs.inc
index 91bcc6e4..32268408 100644
--- a/inc/CryptX_PK_RSA.xs.inc
+++ b/inc/CryptX_PK_RSA.xs.inc
@@ -62,10 +62,51 @@ void
 _import_hex(Crypt::PK::RSA self, char *N, char *e, char *d=NULL, char *p=NULL, char *q=NULL, char *dP=NULL, char *dQ=NULL, char *qP=NULL)
     PPCODE:
     {
-        int rv;
-        if (self->key.type != -1) { rsa_free(&self->key); self->key.type = -1; }
-        rv = rsa_import_radix(16, N, e, d, p, q, dP, dQ, qP, &self->key);
-        if (rv != CRYPT_OK) croak("FATAL: rsa_import_radix failed: %s", error_to_string(rv));
+        int i, rv;
+        unsigned char Nbin[1024], ebin[128], dbin[1024], pbin[512], qbin[512], dPbin[512], dQbin[512], qPbin[512];
+        unsigned long Nlen=sizeof(Nbin), elen=sizeof(ebin), dlen=sizeof(dbin), plen=sizeof(pbin),
+                      qlen=sizeof(qbin), dPlen=sizeof(dPbin), dQlen=sizeof(dQbin), qPlen=sizeof(qPbin);
+
+        rv = radix_to_bin(N,  16,  Nbin,  &Nlen);
+        if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(N) failed: %s", error_to_string(rv));
+        rv = radix_to_bin(e,  16,  ebin,  &elen);
+        if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(e) failed: %s", error_to_string(rv));
+
+        if (d && strlen(d) > 0) {
+          /* private */
+          rv = radix_to_bin(d,  16,  dbin,  &dlen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(d) failed: %s", error_to_string(rv));
+          rv = rsa_set_key(Nbin, Nlen, ebin, elen, dbin, dlen, &self->key);
+          if (rv != CRYPT_OK) croak("FATAL: rsa_set_key failed: %s", error_to_string(rv));
+        }
+        else {
+          /* public */
+          rv = rsa_set_key(Nbin, Nlen, ebin, elen, NULL, 0, &self->key);
+          if (rv != CRYPT_OK) croak("FATAL: rsa_set_key failed: %s", error_to_string(rv));
+        }
+
+        if (p && strlen(p) > 0 && q && strlen(q) > 0) {
+          /* private only */
+          rv = radix_to_bin(p,  16,  pbin,  &plen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(p) failed: %s", error_to_string(rv));
+          rv = radix_to_bin(q,  16,  qbin,  &qlen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(q) failed: %s", error_to_string(rv));
+          rv = rsa_set_factors(pbin, plen, qbin, qlen, &self->key);
+          if (rv != CRYPT_OK) croak("FATAL: rsa_set_factors failed: %s", error_to_string(rv));
+        }
+
+        if (dP && strlen(dP) > 0 && dQ && strlen(dQ) > 0 && qP && strlen(qP) > 0) {
+          /* private only */
+          rv = radix_to_bin(dP, 16, dPbin, &dPlen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(dP) failed: %s", error_to_string(rv));
+          rv = radix_to_bin(dQ, 16, dQbin, &dQlen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(dQ) failed: %s", error_to_string(rv));
+          rv = radix_to_bin(qP, 16, qPbin, &qPlen);
+          if (rv != CRYPT_OK) croak("FATAL: radix_to_bin(qP) failed: %s", error_to_string(rv));
+          rv = rsa_set_crt_params(dPbin, dPlen, dQbin, dQlen, qPbin, qPlen, &self->key);
+          if (rv != CRYPT_OK) croak("FATAL: rsa_set_crt_params failed: %s", error_to_string(rv));
+        }
+
         XPUSHs(ST(0)); /* return self */
     }
 
diff --git a/src/Makefile b/src/Makefile
index 8ff136d3..6f13b41b 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -39,22 +39,22 @@ ltc/mac/pmac/pmac_ntz.o ltc/mac/pmac/pmac_process.o ltc/mac/pmac/pmac_shift_xor.
 ltc/mac/poly1305/poly1305.o ltc/mac/poly1305/poly1305_file.o ltc/mac/poly1305/poly1305_memory.o \
 ltc/mac/poly1305/poly1305_memory_multi.o ltc/mac/xcbc/xcbc_done.o ltc/mac/xcbc/xcbc_file.o \
 ltc/mac/xcbc/xcbc_init.o ltc/mac/xcbc/xcbc_memory.o ltc/mac/xcbc/xcbc_memory_multi.o \
-ltc/mac/xcbc/xcbc_process.o ltc/math/ltm_desc.o ltc/math/multi.o ltc/math/rand_bn.o \
-ltc/math/rand_prime.o ltc/math/tfm_desc.o ltc/math/fp/ltc_ecc_fp_mulmod.o ltc/misc/adler32.o \
-ltc/misc/burn_stack.o ltc/misc/compare_testvector.o ltc/misc/crc32.o ltc/misc/error_to_string.o \
-ltc/misc/mem_neq.o ltc/misc/pk_get_oid.o ltc/misc/zeromem.o ltc/misc/base64/base64_decode.o \
-ltc/misc/base64/base64_encode.o ltc/misc/crypt/crypt.o ltc/misc/crypt/crypt_argchk.o \
-ltc/misc/crypt/crypt_cipher_descriptor.o ltc/misc/crypt/crypt_cipher_is_valid.o ltc/misc/crypt/crypt_find_cipher.o \
-ltc/misc/crypt/crypt_find_cipher_any.o ltc/misc/crypt/crypt_find_cipher_id.o ltc/misc/crypt/crypt_find_hash.o \
-ltc/misc/crypt/crypt_find_hash_any.o ltc/misc/crypt/crypt_find_hash_id.o ltc/misc/crypt/crypt_find_hash_oid.o \
-ltc/misc/crypt/crypt_find_prng.o ltc/misc/crypt/crypt_fsa.o ltc/misc/crypt/crypt_hash_descriptor.o \
-ltc/misc/crypt/crypt_hash_is_valid.o ltc/misc/crypt/crypt_inits.o ltc/misc/crypt/crypt_ltc_mp_descriptor.o \
-ltc/misc/crypt/crypt_prng_descriptor.o ltc/misc/crypt/crypt_prng_is_valid.o ltc/misc/crypt/crypt_register_cipher.o \
-ltc/misc/crypt/crypt_register_hash.o ltc/misc/crypt/crypt_register_prng.o ltc/misc/crypt/crypt_unregister_cipher.o \
-ltc/misc/crypt/crypt_unregister_hash.o ltc/misc/crypt/crypt_unregister_prng.o ltc/misc/hkdf/hkdf.o \
-ltc/misc/pkcs5/pkcs_5_1.o ltc/misc/pkcs5/pkcs_5_2.o ltc/modes/cbc/cbc_decrypt.o ltc/modes/cbc/cbc_done.o \
-ltc/modes/cbc/cbc_encrypt.o ltc/modes/cbc/cbc_getiv.o ltc/modes/cbc/cbc_setiv.o ltc/modes/cbc/cbc_start.o \
-ltc/modes/cfb/cfb_decrypt.o ltc/modes/cfb/cfb_done.o ltc/modes/cfb/cfb_encrypt.o \
+ltc/mac/xcbc/xcbc_process.o ltc/math/ltm_desc.o ltc/math/multi.o ltc/math/radix_to_bin.o \
+ltc/math/rand_bn.o ltc/math/rand_prime.o ltc/math/tfm_desc.o ltc/math/fp/ltc_ecc_fp_mulmod.o \
+ltc/misc/adler32.o ltc/misc/burn_stack.o ltc/misc/compare_testvector.o ltc/misc/crc32.o \
+ltc/misc/error_to_string.o ltc/misc/mem_neq.o ltc/misc/pk_get_oid.o ltc/misc/zeromem.o \
+ltc/misc/base64/base64_decode.o ltc/misc/base64/base64_encode.o ltc/misc/crypt/crypt.o \
+ltc/misc/crypt/crypt_argchk.o ltc/misc/crypt/crypt_cipher_descriptor.o ltc/misc/crypt/crypt_cipher_is_valid.o \
+ltc/misc/crypt/crypt_find_cipher.o ltc/misc/crypt/crypt_find_cipher_any.o ltc/misc/crypt/crypt_find_cipher_id.o \
+ltc/misc/crypt/crypt_find_hash.o ltc/misc/crypt/crypt_find_hash_any.o ltc/misc/crypt/crypt_find_hash_id.o \
+ltc/misc/crypt/crypt_find_hash_oid.o ltc/misc/crypt/crypt_find_prng.o ltc/misc/crypt/crypt_fsa.o \
+ltc/misc/crypt/crypt_hash_descriptor.o ltc/misc/crypt/crypt_hash_is_valid.o ltc/misc/crypt/crypt_inits.o \
+ltc/misc/crypt/crypt_ltc_mp_descriptor.o ltc/misc/crypt/crypt_prng_descriptor.o ltc/misc/crypt/crypt_prng_is_valid.o \
+ltc/misc/crypt/crypt_register_cipher.o ltc/misc/crypt/crypt_register_hash.o ltc/misc/crypt/crypt_register_prng.o \
+ltc/misc/crypt/crypt_unregister_cipher.o ltc/misc/crypt/crypt_unregister_hash.o ltc/misc/crypt/crypt_unregister_prng.o \
+ltc/misc/hkdf/hkdf.o ltc/misc/pkcs5/pkcs_5_1.o ltc/misc/pkcs5/pkcs_5_2.o ltc/modes/cbc/cbc_decrypt.o \
+ltc/modes/cbc/cbc_done.o ltc/modes/cbc/cbc_encrypt.o ltc/modes/cbc/cbc_getiv.o ltc/modes/cbc/cbc_setiv.o \
+ltc/modes/cbc/cbc_start.o ltc/modes/cfb/cfb_decrypt.o ltc/modes/cfb/cfb_done.o ltc/modes/cfb/cfb_encrypt.o \
 ltc/modes/cfb/cfb_getiv.o ltc/modes/cfb/cfb_setiv.o ltc/modes/cfb/cfb_start.o ltc/modes/ctr/ctr_decrypt.o \
 ltc/modes/ctr/ctr_done.o ltc/modes/ctr/ctr_encrypt.o ltc/modes/ctr/ctr_getiv.o ltc/modes/ctr/ctr_setiv.o \
 ltc/modes/ctr/ctr_start.o ltc/modes/ecb/ecb_decrypt.o ltc/modes/ecb/ecb_done.o ltc/modes/ecb/ecb_encrypt.o \
@@ -105,8 +105,8 @@ ltc/pk/pkcs1/pkcs_1_oaep_encode.o ltc/pk/pkcs1/pkcs_1_os2ip.o ltc/pk/pkcs1/pkcs_
 ltc/pk/pkcs1/pkcs_1_pss_encode.o ltc/pk/pkcs1/pkcs_1_v1_5_decode.o ltc/pk/pkcs1/pkcs_1_v1_5_encode.o \
 ltc/pk/rsa/rsa_decrypt_key.o ltc/pk/rsa/rsa_encrypt_key.o ltc/pk/rsa/rsa_export.o \
 ltc/pk/rsa/rsa_exptmod.o ltc/pk/rsa/rsa_free.o ltc/pk/rsa/rsa_get_size.o ltc/pk/rsa/rsa_import.o \
-ltc/pk/rsa/rsa_import_pkcs8.o ltc/pk/rsa/rsa_import_radix.o ltc/pk/rsa/rsa_import_x509.o \
-ltc/pk/rsa/rsa_make_key.o ltc/pk/rsa/rsa_sign_hash.o ltc/pk/rsa/rsa_sign_saltlen_get.o \
+ltc/pk/rsa/rsa_import_pkcs8.o ltc/pk/rsa/rsa_import_x509.o ltc/pk/rsa/rsa_make_key.o \
+ltc/pk/rsa/rsa_set.o ltc/pk/rsa/rsa_sign_hash.o ltc/pk/rsa/rsa_sign_saltlen_get.o \
 ltc/pk/rsa/rsa_verify_hash.o ltc/prngs/chacha20.o ltc/prngs/fortuna.o ltc/prngs/rc4.o \
 ltc/prngs/rng_get_bytes.o ltc/prngs/rng_make_prng.o ltc/prngs/sober128.o ltc/prngs/sprng.o \
 ltc/prngs/yarrow.o ltc/stream/chacha/chacha_crypt.o ltc/stream/chacha/chacha_done.o \
diff --git a/src/Makefile.nmake b/src/Makefile.nmake
index 4ccea7d2..4a2837cb 100644
--- a/src/Makefile.nmake
+++ b/src/Makefile.nmake
@@ -42,12 +42,12 @@ ltc/mac/pmac/pmac_ntz.obj ltc/mac/pmac/pmac_process.obj ltc/mac/pmac/pmac_shift_
 ltc/mac/poly1305/poly1305.obj ltc/mac/poly1305/poly1305_file.obj ltc/mac/poly1305/poly1305_memory.obj \
 ltc/mac/poly1305/poly1305_memory_multi.obj ltc/mac/xcbc/xcbc_done.obj ltc/mac/xcbc/xcbc_file.obj \
 ltc/mac/xcbc/xcbc_init.obj ltc/mac/xcbc/xcbc_memory.obj ltc/mac/xcbc/xcbc_memory_multi.obj \
-ltc/mac/xcbc/xcbc_process.obj ltc/math/ltm_desc.obj ltc/math/multi.obj ltc/math/rand_bn.obj \
-ltc/math/rand_prime.obj ltc/math/tfm_desc.obj ltc/math/fp/ltc_ecc_fp_mulmod.obj ltc/misc/adler32.obj \
-ltc/misc/burn_stack.obj ltc/misc/compare_testvector.obj ltc/misc/crc32.obj ltc/misc/error_to_string.obj \
-ltc/misc/mem_neq.obj ltc/misc/pk_get_oid.obj ltc/misc/zeromem.obj ltc/misc/base64/base64_decode.obj \
-ltc/misc/base64/base64_encode.obj ltc/misc/crypt/crypt.obj ltc/misc/crypt/crypt_argchk.obj \
-ltc/misc/crypt/crypt_cipher_descriptor.obj ltc/misc/crypt/crypt_cipher_is_valid.obj \
+ltc/mac/xcbc/xcbc_process.obj ltc/math/ltm_desc.obj ltc/math/multi.obj ltc/math/radix_to_bin.obj \
+ltc/math/rand_bn.obj ltc/math/rand_prime.obj ltc/math/tfm_desc.obj ltc/math/fp/ltc_ecc_fp_mulmod.obj \
+ltc/misc/adler32.obj ltc/misc/burn_stack.obj ltc/misc/compare_testvector.obj ltc/misc/crc32.obj \
+ltc/misc/error_to_string.obj ltc/misc/mem_neq.obj ltc/misc/pk_get_oid.obj ltc/misc/zeromem.obj \
+ltc/misc/base64/base64_decode.obj ltc/misc/base64/base64_encode.obj ltc/misc/crypt/crypt.obj \
+ltc/misc/crypt/crypt_argchk.obj ltc/misc/crypt/crypt_cipher_descriptor.obj ltc/misc/crypt/crypt_cipher_is_valid.obj \
 ltc/misc/crypt/crypt_find_cipher.obj ltc/misc/crypt/crypt_find_cipher_any.obj ltc/misc/crypt/crypt_find_cipher_id.obj \
 ltc/misc/crypt/crypt_find_hash.obj ltc/misc/crypt/crypt_find_hash_any.obj ltc/misc/crypt/crypt_find_hash_id.obj \
 ltc/misc/crypt/crypt_find_hash_oid.obj ltc/misc/crypt/crypt_find_prng.obj ltc/misc/crypt/crypt_fsa.obj \
@@ -112,8 +112,8 @@ ltc/pk/pkcs1/pkcs_1_oaep_encode.obj ltc/pk/pkcs1/pkcs_1_os2ip.obj ltc/pk/pkcs1/p
 ltc/pk/pkcs1/pkcs_1_pss_encode.obj ltc/pk/pkcs1/pkcs_1_v1_5_decode.obj ltc/pk/pkcs1/pkcs_1_v1_5_encode.obj \
 ltc/pk/rsa/rsa_decrypt_key.obj ltc/pk/rsa/rsa_encrypt_key.obj ltc/pk/rsa/rsa_export.obj \
 ltc/pk/rsa/rsa_exptmod.obj ltc/pk/rsa/rsa_free.obj ltc/pk/rsa/rsa_get_size.obj ltc/pk/rsa/rsa_import.obj \
-ltc/pk/rsa/rsa_import_pkcs8.obj ltc/pk/rsa/rsa_import_radix.obj ltc/pk/rsa/rsa_import_x509.obj \
-ltc/pk/rsa/rsa_make_key.obj ltc/pk/rsa/rsa_sign_hash.obj ltc/pk/rsa/rsa_sign_saltlen_get.obj \
+ltc/pk/rsa/rsa_import_pkcs8.obj ltc/pk/rsa/rsa_import_x509.obj ltc/pk/rsa/rsa_make_key.obj \
+ltc/pk/rsa/rsa_set.obj ltc/pk/rsa/rsa_sign_hash.obj ltc/pk/rsa/rsa_sign_saltlen_get.obj \
 ltc/pk/rsa/rsa_verify_hash.obj ltc/prngs/chacha20.obj ltc/prngs/fortuna.obj ltc/prngs/rc4.obj \
 ltc/prngs/rng_get_bytes.obj ltc/prngs/rng_make_prng.obj ltc/prngs/sober128.obj ltc/prngs/sprng.obj \
 ltc/prngs/yarrow.obj ltc/stream/chacha/chacha_crypt.obj ltc/stream/chacha/chacha_done.obj \
diff --git a/src/ltc/headers/tomcrypt_pk.h b/src/ltc/headers/tomcrypt_pk.h
index fd3f6830..30bd8b43 100644
--- a/src/ltc/headers/tomcrypt_pk.h
+++ b/src/ltc/headers/tomcrypt_pk.h
@@ -127,7 +127,18 @@ int rsa_import(const unsigned char *in, unsigned long inlen, rsa_key *key);
 int rsa_import_x509(const unsigned char *in, unsigned long inlen, rsa_key *key);
 int rsa_import_pkcs8(const unsigned char *in, unsigned long inlen,
                      const void *passwd, unsigned long passwdlen, rsa_key *key);
-int rsa_import_radix(int radix, char *N, char *e, char *d, char *p, char *q, char *dP, char *dQ, char *qP, rsa_key *key);
+
+int rsa_set_key(const unsigned char *N,  unsigned long Nlen,
+                const unsigned char *e,  unsigned long elen,
+                const unsigned char *d,  unsigned long dlen,
+                rsa_key *key);
+int rsa_set_factors(const unsigned char *p,  unsigned long plen,
+                    const unsigned char *q,  unsigned long qlen,
+                    rsa_key *key);
+int rsa_set_crt_params(const unsigned char *dP, unsigned long dPlen,
+                       const unsigned char *dQ, unsigned long dQlen,
+                       const unsigned char *qP, unsigned long qPlen,
+                       rsa_key *key);
 #endif
 
 /* ---- Katja ---- */
diff --git a/src/ltc/math/radix_to_bin.c b/src/ltc/math/radix_to_bin.c
new file mode 100644
index 00000000..fef58ae7
--- /dev/null
+++ b/src/ltc/math/radix_to_bin.c
@@ -0,0 +1,62 @@
+/* LibTomCrypt, modular cryptographic library -- Tom St Denis
+ *
+ * LibTomCrypt is a library that provides various cryptographic
+ * algorithms in a highly modular and flexible manner.
+ *
+ * The library is free for all purposes without any express
+ * guarantee it works.
+ */
+#include "tomcrypt.h"
+
+/**
+   @file radix_to_bin.c
+   Convert data from a specific radix to binary.
+   Steffen Jaeckel
+*/
+
+/**
+   Convert data from a specific radix to binary
+
+      The default MPI descriptors #ltm_desc, #tfm_desc and #gmp_desc
+      have the following restrictions on parameters:
+
+        \p in    - NUL-terminated char buffer
+
+        \p radix - 2..64
+
+   @param in    The input
+   @param radix The radix of the input
+   @param out   The output buffer
+   @param len   [in/out] The length of the output buffer
+
+   @return CRYPT_OK on success.
+*/
+int radix_to_bin(const void *in, int radix, void *out, size_t* len)
+{
+   size_t l;
+   void* mpi;
+   int err;
+
+   LTC_ARGCHK(in  != NULL);
+   LTC_ARGCHK(len != NULL);
+
+   if ((err = mp_init(&mpi)) != CRYPT_OK) return err;
+   if ((err = mp_read_radix(mpi, in, radix)) != CRYPT_OK) goto LBL_ERR;
+
+   if ((l = mp_unsigned_bin_size(mpi)) > *len) {
+      *len = l;
+      err = CRYPT_BUFFER_OVERFLOW;
+      goto LBL_ERR;
+   }
+   *len = l;
+
+   if ((err = mp_to_unsigned_bin(mpi, out)) != CRYPT_OK) goto LBL_ERR;
+
+LBL_ERR:
+   mp_clear(mpi);
+   return err;
+}
+
+/* ref:         $Format:%D$ */
+/* git commit:  $Format:%H$ */
+/* commit time: $Format:%ai$ */
diff --git a/src/ltc/pk/rsa/rsa_decrypt_key.c b/src/ltc/pk/rsa/rsa_decrypt_key.c
index 9e1bcede..9e1bcede 100644..100755
--- a/src/ltc/pk/rsa/rsa_decrypt_key.c
+++ b/src/ltc/pk/rsa/rsa_decrypt_key.c
diff --git a/src/ltc/pk/rsa/rsa_encrypt_key.c b/src/ltc/pk/rsa/rsa_encrypt_key.c
index ef066d2d..ef066d2d 100644..100755
--- a/src/ltc/pk/rsa/rsa_encrypt_key.c
+++ b/src/ltc/pk/rsa/rsa_encrypt_key.c
diff --git a/src/ltc/pk/rsa/rsa_export.c b/src/ltc/pk/rsa/rsa_export.c
index a9885de8..a9885de8 100644..100755
--- a/src/ltc/pk/rsa/rsa_export.c
+++ b/src/ltc/pk/rsa/rsa_export.c
diff --git a/src/ltc/pk/rsa/rsa_exptmod.c b/src/ltc/pk/rsa/rsa_exptmod.c
index 0aa8c1e8..37f62d11 100644..100755
--- a/src/ltc/pk/rsa/rsa_exptmod.c
+++ b/src/ltc/pk/rsa/rsa_exptmod.c
@@ -5,16 +5,13 @@
  *
  * The library is free for all purposes without any express
  * guarantee it works.
- *
- * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
- *
- * Added RSA blinding --nmav
  */
 #include "tomcrypt.h"
 
 /**
   @file rsa_exptmod.c
   RSA PKCS exptmod, Tom St Denis
+  Added RSA blinding --nmav
 */
 
 #ifdef LTC_MRSA
@@ -100,9 +97,11 @@ int rsa_exptmod(const unsigned char *in,   unsigned long inlen,
       }
       #endif /* LTC_RSA_BLINDING */
 
-      has_crt_parameters = (key->dP != NULL) && (mp_get_digit_count(key->dP) != 0) &&
-                              (key->dQ != NULL) && (mp_get_digit_count(key->dQ) != 0) &&
-                                 (key->qP != NULL) && (mp_get_digit_count(key->qP) != 0);
+      has_crt_parameters = (key->p != NULL) && (mp_get_digit_count(key->p) != 0) &&
+                              (key->q != NULL) && (mp_get_digit_count(key->q) != 0) &&
+                                 (key->dP != NULL) && (mp_get_digit_count(key->dP) != 0) &&
+                                    (key->dQ != NULL) && (mp_get_digit_count(key->dQ) != 0) &&
+                                       (key->qP != NULL) && (mp_get_digit_count(key->qP) != 0);
 
       if (!has_crt_parameters) {
          /*
diff --git a/src/ltc/pk/rsa/rsa_free.c b/src/ltc/pk/rsa/rsa_free.c
index 48039e4a..1e62f097 100644..100755
--- a/src/ltc/pk/rsa/rsa_free.c
+++ b/src/ltc/pk/rsa/rsa_free.c
@@ -22,7 +22,7 @@
 void rsa_free(rsa_key *key)
 {
    LTC_ARGCHKVD(key != NULL);
-   mp_clear_multi(key->q, key->p, key->qP, key->dP, key->dQ, key->N, key->d, key->e, NULL);
+   mp_cleanup_multi(&key->q, &key->p, &key->qP, &key->dP, &key->dQ, &key->N, &key->d, &key->e, NULL);
 }
 
 #endif
diff --git a/src/ltc/pk/rsa/rsa_get_size.c b/src/ltc/pk/rsa/rsa_get_size.c
index 1e6e2c14..8c901947 100644..100755
--- a/src/ltc/pk/rsa/rsa_get_size.c
+++ b/src/ltc/pk/rsa/rsa_get_size.c
@@ -5,8 +5,6 @@
  *
  * The library is free for all purposes without any express
  * guarantee it works.
- *
- * http://libtom.org
  */
 #include "tomcrypt.h"
 
diff --git a/src/ltc/pk/rsa/rsa_import.c b/src/ltc/pk/rsa/rsa_import.c
index a6be18d3..a6be18d3 100644..100755
--- a/src/ltc/pk/rsa/rsa_import.c
+++ b/src/ltc/pk/rsa/rsa_import.c
diff --git a/src/ltc/pk/rsa/rsa_import_pkcs8.c b/src/ltc/pk/rsa/rsa_import_pkcs8.c
index 0dd3a64c..480d6636 100644..100755
--- a/src/ltc/pk/rsa/rsa_import_pkcs8.c
+++ b/src/ltc/pk/rsa/rsa_import_pkcs8.c
@@ -73,14 +73,14 @@ int rsa_import_pkcs8(const unsigned char *in, unsigned long inlen,
    /* alloc buffers */
    buf1len = inlen; /* approx. */
    buf1 = XMALLOC(buf1len);
-   if (buf1 == NULL) { err = CRYPT_MEM; goto LBL_NOCLEAR; }
+   if (buf1 == NULL) { err = CRYPT_MEM; goto LBL_NOFREE; }
    buf2len = inlen; /* approx. */
    buf2 = XMALLOC(buf2len);
-   if (buf2 == NULL) { err = CRYPT_MEM; goto LBL_FREE; }
+   if (buf2 == NULL) { err = CRYPT_MEM; goto LBL_FREE1; }
 
    /* init key */
    err = mp_init_multi(&key->e, &key->d, &key->N, &key->dQ, &key->dP, &key->qP, &key->p, &key->q, &zero, &iter, NULL);
-   if (err != CRYPT_OK) { goto LBL_NOCLEAR; }
+   if (err != CRYPT_OK) { goto LBL_FREE2; }
 
    /* try to decode encrypted priv key */
    LTC_SET_ASN1(key_seq_e, 0, LTC_ASN1_OCTET_STRING, buf1, buf1len);
@@ -134,16 +134,20 @@ int rsa_import_pkcs8(const unsigned char *in, unsigned long inlen,
    mp_clear_multi(zero, iter, NULL);
    key->type = PK_PRIVATE;
    err = CRYPT_OK;
-   goto LBL_FREE;
+   goto LBL_FREE2;
 
 LBL_ERR:
    mp_clear_multi(key->d, key->e, key->N, key->dQ, key->dP, key->qP, key->p, key->q, zero, iter, NULL);
-LBL_NOCLEAR:
+LBL_FREE2:
    XFREE(buf2);
-LBL_FREE:
+LBL_FREE1:
    XFREE(buf1);
 LBL_NOFREE:
    return err;
 }
 
 #endif /* LTC_MRSA */
+
+/* ref:         $Format:%D$ */
+/* git commit:  $Format:%H$ */
+/* commit time: $Format:%ai$ */
diff --git a/src/ltc/pk/rsa/rsa_import_radix.c b/src/ltc/pk/rsa/rsa_import_radix.c
deleted file mode 100644
index 4ec10388..00000000
--- a/src/ltc/pk/rsa/rsa_import_radix.c
+++ /dev/null
@@ -1,62 +0,0 @@
-/* LibTomCrypt, modular cryptographic library -- Tom St Denis
- *
- * LibTomCrypt is a library that provides various cryptographic
- * algorithms in a highly modular and flexible manner.
- *
- * The library is free for all purposes without any express
- * guarantee it works.
- */
-#include "tomcrypt.h"
-
-/**
-  Import RSA public or private key from raw numbers
-  @param radix   the radix the numbers are represented in (2-64, 16 = hexadecimal)
-  @param N       RSA's N  in radix representation
-  @param e       RSA's e  in radix representation
-  @param d       RSA's d  in radix representation (only private key, NULL for public key)
-  @param p       RSA's p  in radix representation (only private key, NULL for public key)
-  @param q       RSA's q  in radix representation (only private key, NULL for public key)
-  @param dP      RSA's dP in radix representation (only private key, NULL for public key)
-  @param dQ      RSA's dQ in radix representation (only private key, NULL for public key)
-  @param qP      RSA's qP in radix representation (only private key, NULL for public key)
-  @param key     [out] the destination for the imported key
-  @return CRYPT_OK if successful, upon error allocated memory is freed
-*/
-
-#ifdef LTC_MRSA
-
-int rsa_import_radix(int radix, char *N, char *e, char *d, char *p, char *q, char *dP, char *dQ, char *qP, rsa_key *key)
-{
-   int err;
-
-   LTC_ARGCHK(key         != NULL);
-   LTC_ARGCHK(N           != NULL);
-   LTC_ARGCHK(e           != NULL);
-   LTC_ARGCHK(ltc_mp.name != NULL);
-
-   err = mp_init_multi(&key->e, &key->d, &key->N, &key->dQ, &key->dP, &key->qP, &key->p, &key->q, NULL);
-   if (err != CRYPT_OK) return err;
-
-   if ((err = mp_read_radix(key->N , N , radix)) != CRYPT_OK)    { goto LBL_ERR; }
-   if ((err = mp_read_radix(key->e , e , radix)) != CRYPT_OK)    { goto LBL_ERR; }
-   if (d && p && q && dP && dQ && qP && strlen(d)>0 && strlen(p)>0 &&
-       strlen(q)>0 && strlen(dP)>0 && strlen(dQ)>0 && strlen(qP)>0) {
-      if ((err = mp_read_radix(key->d , d , radix)) != CRYPT_OK) { goto LBL_ERR; }
-      if ((err = mp_read_radix(key->p , p , radix)) != CRYPT_OK) { goto LBL_ERR; }
-      if ((err = mp_read_radix(key->q , q , radix)) != CRYPT_OK) { goto LBL_ERR; }
-      if ((err = mp_read_radix(key->dP, dP, radix)) != CRYPT_OK) { goto LBL_ERR; }
-      if ((err = mp_read_radix(key->dQ, dQ, radix)) != CRYPT_OK) { goto LBL_ERR; }
-      if ((err = mp_read_radix(key->qP, qP, radix)) != CRYPT_OK) { goto LBL_ERR; }
-      key->type = PK_PRIVATE;
-   }
-   else {
-      key->type = PK_PUBLIC;
-   }
-   return CRYPT_OK;
-
-LBL_ERR:
-   mp_clear_multi(key->d,  key->e, key->N, key->dQ, key->dP, key->qP, key->p, key->q, NULL);
-   return err;
-}
-
-#endif /* LTC_MRSA */
diff --git a/src/ltc/pk/rsa/rsa_import_x509.c b/src/ltc/pk/rsa/rsa_import_x509.c
index c57d6ea8..c57d6ea8 100644..100755
--- a/src/ltc/pk/rsa/rsa_import_x509.c
+++ b/src/ltc/pk/rsa/rsa_import_x509.c
diff --git a/src/ltc/pk/rsa/rsa_make_key.c b/src/ltc/pk/rsa/rsa_make_key.c
index 23b98e04..23b98e04 100644..100755
--- a/src/ltc/pk/rsa/rsa_make_key.c
+++ b/src/ltc/pk/rsa/rsa_make_key.c
diff --git a/src/ltc/pk/rsa/rsa_set.c b/src/ltc/pk/rsa/rsa_set.c
new file mode 100644
index 00000000..0d540c4d
--- /dev/null
+++ b/src/ltc/pk/rsa/rsa_set.c
@@ -0,0 +1,134 @@
+/* LibTomCrypt, modular cryptographic library -- Tom St Denis
+ *
+ * LibTomCrypt is a library that provides various cryptographic
+ * algorithms in a highly modular and flexible manner.
+ *
+ * The library is free for all purposes without any express
+ * guarantee it works.
+ */
+#include "tomcrypt.h"
+
+
+#ifdef LTC_MRSA
+
+/**
+  Import RSA key from raw numbers
+
+  @param N       RSA's N
+  @param Nlen    RSA's N's length
+  @param e       RSA's e
+  @param elen    RSA's e's length
+  @param d       RSA's d  (only private key, NULL for public key)
+  @param dlen    RSA's d's length
+  @param key     [out] the destination for the imported key
+  @return CRYPT_OK if successful
+*/
+int rsa_set_key(const unsigned char *N,  unsigned long Nlen,
+                const unsigned char *e,  unsigned long elen,
+                const unsigned char *d,  unsigned long dlen,
+                rsa_key *key)
+{
+   int err;
+
+   LTC_ARGCHK(key         != NULL);
+   LTC_ARGCHK(N           != NULL);
+   LTC_ARGCHK(e           != NULL);
+   LTC_ARGCHK(ltc_mp.name != NULL);
+
+   err = mp_init_multi(&key->e, &key->d, &key->N, &key->dQ, &key->dP, &key->qP, &key->p, &key->q, NULL);
+   if (err != CRYPT_OK) return err;
+
+   if ((err = mp_read_unsigned_bin(key->N , (unsigned char *)N , Nlen)) != CRYPT_OK)    { goto LBL_ERR; }
+   if ((err = mp_read_unsigned_bin(key->e , (unsigned char *)e , elen)) != CRYPT_OK)    { goto LBL_ERR; }
+   if (d && dlen) {
+      if ((err = mp_read_unsigned_bin(key->d , (unsigned char *)d , dlen)) != CRYPT_OK) { goto LBL_ERR; }
+      key->type = PK_PRIVATE;
+   }
+   else {
+      key->type = PK_PUBLIC;
+   }
+   return CRYPT_OK;
+
+LBL_ERR:
+   rsa_free(key);
+   return err;
+}
+
+/**
+  Import factors of an RSA key from raw numbers
+
+  Only for private keys.
+
+  @param p       RSA's p
+  @param plen    RSA's p's length
+  @param q       RSA's q
+  @param qlen    RSA's q's length
+  @param key     [out] the destination for the imported key
+  @return CRYPT_OK if successful
+*/
+int rsa_set_factors(const unsigned char *p,  unsigned long plen,
+                    const unsigned char *q,  unsigned long qlen,
+                    rsa_key *key)
+{
+   int err;
+
+   LTC_ARGCHK(key         != NULL);
+   LTC_ARGCHK(p           != NULL);
+   LTC_ARGCHK(q           != NULL);
+   LTC_ARGCHK(ltc_mp.name != NULL);
+
+   if (key->type != PK_PRIVATE) return CRYPT_PK_TYPE_MISMATCH;
+
+   if ((err = mp_read_unsigned_bin(key->p , (unsigned char *)p , plen)) != CRYPT_OK) { goto LBL_ERR; }
+   if ((err = mp_read_unsigned_bin(key->q , (unsigned char *)q , qlen)) != CRYPT_OK) { goto LBL_ERR; }
+   return CRYPT_OK;
+
+LBL_ERR:
+   rsa_free(key);
+   return err;
+}
+
+/**
+  Import CRT parameters of an RSA key from raw numbers
+
+  Only for private keys.
+
+  @param dP      RSA's dP
+  @param dPlen   RSA's dP's length
+  @param dQ      RSA's dQ
+  @param dQlen   RSA's dQ's length
+  @param qP      RSA's qP
+  @param qPlen   RSA's qP's length
+  @param key     [out] the destination for the imported key
+  @return CRYPT_OK if successful
+*/
+int rsa_set_crt_params(const unsigned char *dP, unsigned long dPlen,
+                       const unsigned char *dQ, unsigned long dQlen,
+                       const unsigned char *qP, unsigned long qPlen,
+                       rsa_key *key)
+{
+   int err;
+
+   LTC_ARGCHK(key         != NULL);
+   LTC_ARGCHK(dP          != NULL);
+   LTC_ARGCHK(dQ          != NULL);
+   LTC_ARGCHK(qP          != NULL);
+   LTC_ARGCHK(ltc_mp.name != NULL);
+
+   if (key->type != PK_PRIVATE) return CRYPT_PK_TYPE_MISMATCH;
+
+   if ((err = mp_read_unsigned_bin(key->dP, (unsigned char *)dP, dPlen)) != CRYPT_OK) { goto LBL_ERR; }
+   if ((err = mp_read_unsigned_bin(key->dQ, (unsigned char *)dQ, dQlen)) != CRYPT_OK) { goto LBL_ERR; }
+   if ((err = mp_read_unsigned_bin(key->qP, (unsigned char *)qP, qPlen)) != CRYPT_OK) { goto LBL_ERR; }
+   return CRYPT_OK;
+
+LBL_ERR:
+   rsa_free(key);
+   return err;
+}
+
+#endif /* LTC_MRSA */
+
+/* ref:         $Format:%D$ */
+/* git commit:  $Format:%H$ */
+/* commit time: $Format:%ai$ */
diff --git a/src/ltc/pk/rsa/rsa_sign_hash.c b/src/ltc/pk/rsa/rsa_sign_hash.c
index d668de35..05c7155d 100644..100755
--- a/src/ltc/pk/rsa/rsa_sign_hash.c
+++ b/src/ltc/pk/rsa/rsa_sign_hash.c
@@ -21,7 +21,7 @@
   @param inlen     The length of the hash to sign (octets)
   @param out       [out] The signature
   @param outlen    [in/out] The max size and resulting size of the signature
-  @param padding   Type of padding (LTC_PKCS_1_PSS or LTC_PKCS_1_V1_5)
+  @param padding   Type of padding (LTC_PKCS_1_PSS, LTC_PKCS_1_V1_5 or LTC_PKCS_1_V1_5_NA1)
   @param prng      An active PRNG state
   @param prng_idx  The index of the PRNG desired
   @param hash_idx  The index of the hash desired
@@ -45,15 +45,21 @@ int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
    LTC_ARGCHK(key      != NULL);
 
    /* valid padding? */
-   if ((padding != LTC_PKCS_1_V1_5) && (padding != LTC_PKCS_1_PSS)) {
+   if ((padding != LTC_PKCS_1_V1_5) &&
+       (padding != LTC_PKCS_1_PSS) &&
+       (padding != LTC_PKCS_1_V1_5_NA1)) {
      return CRYPT_PK_INVALID_PADDING;
    }
 
    if (padding == LTC_PKCS_1_PSS) {
-     /* valid prng and hash ? */
+     /* valid prng ? */
      if ((err = prng_is_valid(prng_idx)) != CRYPT_OK) {
         return err;
      }
+   }
+
+   if (padding != LTC_PKCS_1_V1_5_NA1) {
+     /* valid hash ? */
      if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
         return err;
      }
@@ -79,46 +85,54 @@ int rsa_sign_hash_ex(const unsigned char *in,       unsigned long  inlen,
   } else {
     /* PKCS #1 v1.5 pad the hash */
     unsigned char *tmpin;
-    ltc_asn1_list digestinfo[2], siginfo[2];
 
-    /* not all hashes have OIDs... so sad */
-    if (hash_descriptor[hash_idx].OIDlen == 0) {
-       return CRYPT_INVALID_ARG;
-    }
+    if (padding == LTC_PKCS_1_V1_5) {
+      ltc_asn1_list digestinfo[2], siginfo[2];
+      /* not all hashes have OIDs... so sad */
+      if (hash_descriptor[hash_idx].OIDlen == 0) {
+         return CRYPT_INVALID_ARG;
+      }
 
     /* construct the SEQUENCE
-      SEQUENCE {
-         SEQUENCE {hashoid OID
-                   blah    NULL
-         }
+        SEQUENCE {
+           SEQUENCE {hashoid OID
+                     blah    NULL
+           }
          hash    OCTET STRING
+        }
+     */
+      LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, hash_descriptor[hash_idx].OID, hash_descriptor[hash_idx].OIDlen);
+      LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL,              NULL,                          0);
+      LTC_SET_ASN1(siginfo,    0, LTC_ASN1_SEQUENCE,          digestinfo,                    2);
+      LTC_SET_ASN1(siginfo,    1, LTC_ASN1_OCTET_STRING,      in,                            inlen);
+
+      /* allocate memory for the encoding */
+      y = mp_unsigned_bin_size(key->N);
+      tmpin = XMALLOC(y);
+      if (tmpin == NULL) {
+         return CRYPT_MEM;
       }
-   */
-    LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, hash_descriptor[hash_idx].OID, hash_descriptor[hash_idx].OIDlen);
-    LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL,              NULL,                          0);
-    LTC_SET_ASN1(siginfo,    0, LTC_ASN1_SEQUENCE,          digestinfo,                    2);
-    LTC_SET_ASN1(siginfo,    1, LTC_ASN1_OCTET_STRING,      in,                            inlen);
-
-    /* allocate memory for the encoding */
-    y = mp_unsigned_bin_size(key->N);
-    tmpin = XMALLOC(y);
-    if (tmpin == NULL) {
-       return CRYPT_MEM;
-    }
 
-    if ((err = der_encode_sequence(siginfo, 2, tmpin, &y)) != CRYPT_OK) {
-       XFREE(tmpin);
-       return err;
+      if ((err = der_encode_sequence(siginfo, 2, tmpin, &y)) != CRYPT_OK) {
+         XFREE(tmpin);
+         return err;
+      }
+    } else {
+      /* set the pointer and data-length to the input values */
+      tmpin = (unsigned char *)in;
+      y = inlen;
     }
 
     x = *outlen;
-    if ((err = pkcs_1_v1_5_encode(tmpin, y, LTC_PKCS_1_EMSA,
-                                  modulus_bitlen, NULL, 0,
-                                  out, &x)) != CRYPT_OK) {
+    err = pkcs_1_v1_5_encode(tmpin, y, LTC_PKCS_1_EMSA, modulus_bitlen, NULL, 0, out, &x);
+
+    if (padding == LTC_PKCS_1_V1_5) {
       XFREE(tmpin);
+    }
+
+    if (err != CRYPT_OK) {
       return err;
     }
-    XFREE(tmpin);
   }
 
   /* RSA encode it */
diff --git a/src/ltc/pk/rsa/rsa_sign_saltlen_get.c b/src/ltc/pk/rsa/rsa_sign_saltlen_get.c
index 8a9235e9..b217f94e 100644..100755
--- a/src/ltc/pk/rsa/rsa_sign_saltlen_get.c
+++ b/src/ltc/pk/rsa/rsa_sign_saltlen_get.c
@@ -5,8 +5,6 @@
  *
  * The library is free for all purposes without any express
  * guarantee it works.
- *
- * http://libtom.org
  */
 #include "tomcrypt.h"
 
diff --git a/src/ltc/pk/rsa/rsa_verify_hash.c b/src/ltc/pk/rsa/rsa_verify_hash.c
index 010cf323..89981222 100644..100755
--- a/src/ltc/pk/rsa/rsa_verify_hash.c
+++ b/src/ltc/pk/rsa/rsa_verify_hash.c
@@ -21,7 +21,7 @@
   @param siglen           The length of the signature data (octets)
   @param hash             The hash of the message that was signed
   @param hashlen          The length of the hash of the message that was signed (octets)
-  @param padding          Type of padding (LTC_PKCS_1_PSS or LTC_PKCS_1_V1_5)
+  @param padding          Type of padding (LTC_PKCS_1_PSS, LTC_PKCS_1_V1_5 or LTC_PKCS_1_V1_5_NA1)
   @param hash_idx         The index of the desired hash
   @param saltlen          The length of the salt used during signature
   @param stat             [out] The result of the signature comparison, 1==valid, 0==invalid
@@ -49,11 +49,12 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
   /* valid padding? */
 
   if ((padding != LTC_PKCS_1_V1_5) &&
-      (padding != LTC_PKCS_1_PSS)) {
+      (padding != LTC_PKCS_1_PSS) &&
+      (padding != LTC_PKCS_1_V1_5_NA1)) {
     return CRYPT_PK_INVALID_PADDING;
   }
 
-  if (padding == LTC_PKCS_1_PSS) {
+  if (padding != LTC_PKCS_1_V1_5_NA1) {
     /* valid hash ? */
     if ((err = hash_is_valid(hash_idx)) != CRYPT_OK) {
        return err;
@@ -101,15 +102,8 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
   } else {
     /* PKCS #1 v1.5 decode it */
     unsigned char *out;
-    unsigned long outlen, loid[16], reallen;
+    unsigned long outlen;
     int           decoded;
-    ltc_asn1_list digestinfo[2], siginfo[2];
-
-    /* not all hashes have OIDs... so sad */
-    if (hash_descriptor[hash_idx].OIDlen == 0) {
-       err = CRYPT_INVALID_ARG;
-       goto bail_2;
-    }
 
     /* allocate temp buffer for decoded hash */
     outlen = ((modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0)) - 3;
@@ -124,37 +118,54 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
       goto bail_2;
     }
 
-    /* now we must decode out[0...outlen-1] using ASN.1, test the OID and then test the hash */
-    /* construct the SEQUENCE
-      SEQUENCE {
-         SEQUENCE {hashoid OID
-                   blah    NULL
-         }
-         hash    OCTET STRING
+    if (padding == LTC_PKCS_1_V1_5) {
+      unsigned long loid[16], reallen;
+      ltc_asn1_list digestinfo[2], siginfo[2];
+
+      /* not all hashes have OIDs... so sad */
+      if (hash_descriptor[hash_idx].OIDlen == 0) {
+         err = CRYPT_INVALID_ARG;
+         goto bail_2;
       }
-   */
-    LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, loid, sizeof(loid)/sizeof(loid[0]));
-    LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL,              NULL,                          0);
-    LTC_SET_ASN1(siginfo,    0, LTC_ASN1_SEQUENCE,          digestinfo,                    2);
-    LTC_SET_ASN1(siginfo,    1, LTC_ASN1_OCTET_STRING,      tmpbuf,                        siglen);
-
-    if ((err = der_decode_sequence(out, outlen, siginfo, 2)) != CRYPT_OK) {
-       XFREE(out);
-       goto bail_2;
-    }
 
-    if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
-       XFREE(out);
-       goto bail_2;
-    }
+      /* now we must decode out[0...outlen-1] using ASN.1, test the OID and then test the hash */
+      /* construct the SEQUENCE
+        SEQUENCE {
+           SEQUENCE {hashoid OID
+                     blah    NULL
+           }
+           hash    OCTET STRING
+        }
+     */
+      LTC_SET_ASN1(digestinfo, 0, LTC_ASN1_OBJECT_IDENTIFIER, loid, sizeof(loid)/sizeof(loid[0]));
+      LTC_SET_ASN1(digestinfo, 1, LTC_ASN1_NULL,              NULL,                          0);
+      LTC_SET_ASN1(siginfo,    0, LTC_ASN1_SEQUENCE,          digestinfo,                    2);
+      LTC_SET_ASN1(siginfo,    1, LTC_ASN1_OCTET_STRING,      tmpbuf,                        siglen);
+
+      if ((err = der_decode_sequence(out, outlen, siginfo, 2)) != CRYPT_OK) {
+         XFREE(out);
+         goto bail_2;
+      }
+
+      if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
+         XFREE(out);
+         goto bail_2;
+      }
 
-    /* test OID */
-    if ((reallen == outlen) &&
-        (digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
-        (XMEM_NEQ(digestinfo[0].data, hash_descriptor[hash_idx].OID, sizeof(unsigned long) * hash_descriptor[hash_idx].OIDlen) == 0) &&
-        (siginfo[1].size == hashlen) &&
-        (XMEM_NEQ(siginfo[1].data, hash, hashlen) == 0)) {
-       *stat = 1;
+      /* test OID */
+      if ((reallen == outlen) &&
+          (digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
+        (XMEMCMP(digestinfo[0].data, hash_descriptor[hash_idx].OID, sizeof(unsigned long) * hash_descriptor[hash_idx].OIDlen) == 0) &&
+          (siginfo[1].size == hashlen) &&
+        (XMEMCMP(siginfo[1].data, hash, hashlen) == 0)) {
+         *stat = 1;
+      }
+    } else {
+      /* only check if the hash is equal */
+      if ((hashlen == outlen) &&
+          (XMEMCMP(out, hash, hashlen) == 0)) {
+        *stat = 1;
+      }
     }
 
 #ifdef LTC_CLEAN_STACK