CVE-2020-36315: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE: this requires that a low public exponent (such as 3) is being used. The product, by default, does not generate RSA keys with such a low number.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 5.3
Published: 2021-04-07T21:15Z
Repository: https://github.com/relic-toolkit/relic
Language: C
Files changed: src/cp/relic_cp_rsa.c
Commit date: 2020-08-02 01:53:19 +0200
Commit message: Fix #154 and #155 by inverting the padding check logic and being more rigorous.

Diff: diff --git a/src/cp/relic_cp_rsa.c b/src/cp/relic_cp_rsa.c
index 9cb4850b..c36364cd 100644
--- a/src/cp/relic_cp_rsa.c
+++ b/src/cp/relic_cp_rsa.c
@@ -127,11 +127,11 @@
  * @param[in] operation	- flag to indicate the operation type.
  * @return RLC_ERR if errors occurred, RLC_OK otherwise.
  */
 static int pad_basic(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 	uint8_t pad = 0;
-	int result = RLC_OK;
+	int result = RLC_ERR;
 	bn_t t;
 
 	RLC_TRY {
 		bn_null(t);
 		bn_new(t);
@@ -144,31 +144,31 @@ static int pad_basic(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				bn_zero(m);
 				bn_lsh(m, m, 8);
 				bn_add_dig(m, m, RSA_PAD);
 				/* Make room for the real message. */
 				bn_lsh(m, m, m_len * 8);
+				result = RLC_OK;
 				break;
 			case RSA_DEC:
 			case RSA_VER:
 			case RSA_VER_HASH:
 				/* EB = 00 | FF | D. */
 				m_len = k_len - 1;
 				bn_rsh(t, m, 8 * m_len);
-				if (!bn_is_zero(t)) {
-					result = RLC_ERR;
-				}
-				*p_len = 1;
-				do {
-					(*p_len)++;
-					m_len--;
-					bn_rsh(t, m, 8 * m_len);
-					pad = (uint8_t)t->dp[0];
-				} while (pad == 0 && m_len > 0);
-				if (pad != RSA_PAD) {
-					result = RLC_ERR;
+				if (bn_is_zero(t)) {
+					*p_len = 1;
+					do {
+						(*p_len)++;
+						m_len--;
+						bn_rsh(t, m, 8 * m_len);
+						pad = (uint8_t)t->dp[0];
+					} while (pad == 0 && m_len > 0);
+					if (pad == RSA_PAD) {
+						result = RLC_OK;
+					}
+					bn_mod_2b(m, m, (k_len - *p_len) * 8);
 				}
-				bn_mod_2b(m, m, (k_len - *p_len) * 8);
 				break;
 		}
 	}
 	RLC_CATCH_ANY {
 		result = RLC_ERR;
@@ -249,11 +249,11 @@ static uint8_t *hash_id(int md, int *len) {
  * @param[in] operation	- flag to indicate the operation type.
  * @return RLC_ERR if errors occurred, RLC_OK otherwise.
  */
 static int pad_pkcs1(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 	uint8_t *id, pad = 0;
-	int len, result = RLC_OK;
+	int len, result = RLC_ERR;
 	bn_t t;
 
 	bn_null(t);
 
 	RLC_TRY {
@@ -276,33 +276,32 @@ static int pad_pkcs1(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				}
 				bn_lsh(m, m, 8);
 				bn_add_dig(m, m, 0);
 				/* Make room for the real message. */
 				bn_lsh(m, m, m_len * 8);
+				result = RLC_OK;
 				break;
 			case RSA_DEC:
 				m_len = k_len - 1;
 				bn_rsh(t, m, 8 * m_len);
-				if (!bn_is_zero(t)) {
-					result = RLC_ERR;
-				}
-
-				*p_len = m_len;
-				m_len--;
-				bn_rsh(t, m, 8 * m_len);
-				pad = (uint8_t)t->dp[0];
-				if (pad != RSA_PUB) {
-					result = RLC_ERR;
-				}
-				do {
+				if (bn_is_zero(t)) {
+					*p_len = m_len;
 					m_len--;
 					bn_rsh(t, m, 8 * m_len);
 					pad = (uint8_t)t->dp[0];
-				} while (pad != 0 && m_len > 0);
-				/* Remove padding and trailing zero. */
-				*p_len -= (m_len - 1);
-				bn_mod_2b(m, m, (k_len - *p_len) * 8);
+					if (pad == RSA_PUB) {
+						do {
+							m_len--;
+							bn_rsh(t, m, 8 * m_len);
+							pad = (uint8_t)t->dp[0];
+						} while (pad != 0 && m_len > 0);
+						/* Remove padding and trailing zero. */
+						*p_len -= (m_len - 1);
+						bn_mod_2b(m, m, (k_len - *p_len) * 8);
+						result = (m_len > 0 ? RLC_OK : RLC_ERR);
+					}
+				}
 				break;
 			case RSA_SIG:
 				/* EB = 00 | 01 | PS | 00 | D. */
 				id = hash_id(MD_MAP, &len);
 				bn_zero(m);
@@ -319,10 +318,11 @@ static int pad_pkcs1(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				bn_lsh(m, m, 8 * len);
 				bn_read_bin(t, id, len);
 				bn_add(m, m, t);
 				/* Make room for the real message. */
 				bn_lsh(m, m, m_len * 8);
+				result = RLC_OK;
 				break;
 			case RSA_SIG_HASH:
 				/* EB = 00 | 01 | PS | 00 | D. */
 				bn_zero(m);
 				bn_lsh(m, m, 8);
@@ -335,69 +335,69 @@ static int pad_pkcs1(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				}
 				bn_lsh(m, m, 8);
 				bn_add_dig(m, m, 0);
 				/* Make room for the real message. */
 				bn_lsh(m, m, m_len * 8);
+				result = RLC_OK;
 				break;
 			case RSA_VER:
 				m_len = k_len - 1;
 				bn_rsh(t, m, 8 * m_len);
-				if (!bn_is_zero(t)) {
-					result = RLC_ERR;
-				}
-				m_len--;
-				bn_rsh(t, m, 8 * m_len);
-				pad = (uint8_t)t->dp[0];
-				if (pad != RSA_PRV) {
-					result = RLC_ERR;
-				}
-				do {
+				if (bn_is_zero(t)) {
 					m_len--;
 					bn_rsh(t, m, 8 * m_len);
 					pad = (uint8_t)t->dp[0];
-				} while (pad != 0 && m_len > 0);
-				if (m_len == 0) {
-					result = RLC_ERR;
-				}
-				/* Remove padding and trailing zero. */
-				id = hash_id(MD_MAP, &len);
-				m_len -= len;
-
-				bn_rsh(t, m, m_len * 8);
-				int r = 0;
-				for (int i = 0; i < len; i++) {
-					pad = (uint8_t)t->dp[0];
-					r |= pad - id[len - i - 1];
-					bn_rsh(t, t, 8);
+					if (pad == RSA_PRV) {
+						int counter = 0;
+						do {
+							counter++;
+							m_len--;
+							bn_rsh(t, m, 8 * m_len);
+							pad = (uint8_t)t->dp[0];
+						} while (pad == RSA_PAD && m_len > 0);
+						/* Remove padding and trailing zero. */
+						id = hash_id(MD_MAP, &len);
+						m_len -= len;
+
+						bn_rsh(t, m, m_len * 8);
+						int r = 0;
+						for (int i = 0; i < len; i++) {
+							pad = (uint8_t)t->dp[0];
+							r |= pad ^ id[len - i - 1];
+							bn_rsh(t, t, 8);
+						}
+						*p_len = k_len - m_len;
+						bn_mod_2b(m, m, m_len * 8);
+						if (r && m_len > 0 && counter >= 8) {
+							result = RLC_OK;
+						}
+					}
 				}
-				*p_len = k_len - m_len;
-				bn_mod_2b(m, m, m_len * 8);
-				result = (r == 0 ? RLC_OK : RLC_ERR);
 				break;
 			case RSA_VER_HASH:
 				m_len = k_len - 1;
 				bn_rsh(t, m, 8 * m_len);
-				if (!bn_is_zero(t)) {
-					result = RLC_ERR;
-				}
-				m_len--;
-				bn_rsh(t, m, 8 * m_len);
-				pad = (uint8_t)t->dp[0];
-				if (pad != RSA_PRV) {
-					result = RLC_ERR;
-				}
-				do {
+				if (bn_is_zero(t)) {
 					m_len--;
 					bn_rsh(t, m, 8 * m_len);
 					pad = (uint8_t)t->dp[0];
-				} while (pad != 0 && m_len > 0);
-				if (m_len == 0) {
-					result = RLC_ERR;
+					if (pad == RSA_PRV) {
+						int counter = 0;
+						do {
+							counter++;
+							m_len--;
+							bn_rsh(t, m, 8 * m_len);
+							pad = (uint8_t)t->dp[0];
+						} while (pad == RSA_PAD && m_len > 0);
+						/* Remove padding and trailing zero. */
+						*p_len = k_len - m_len;
+						bn_mod_2b(m, m, m_len * 8);
+						if (m_len > 0 && counter >= 8) {
+							result = RLC_OK;
+						}
+					}
 				}
-				/* Remove padding and trailing zero. */
-				*p_len = k_len - m_len;
-				bn_mod_2b(m, m, m_len * 8);
 				break;
 		}
 	}
 	RLC_CATCH_ANY {
 		result = RLC_ERR;
@@ -424,11 +424,11 @@ static int pad_pkcs1(bn_t m, int *p_len, int m_len, int k_len, int operation) {
  */
 static int pad_pkcs2(bn_t m, int *p_len, int m_len, int k_len, int operation) {
         uint8_t pad, h1[RLC_MD_LEN], h2[RLC_MD_LEN];
         /* MSVC does not allow dynamic stack arrays */
         uint8_t *mask = RLC_ALLOCA(uint8_t, k_len);
-	int result = RLC_OK;
+	int result = RLC_ERR;
 	bn_t t;
 
 	bn_null(t);
 
 	RLC_TRY {
@@ -443,10 +443,11 @@ static int pad_pkcs2(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				bn_lsh(m, m, *p_len * 8);
 				bn_lsh(m, m, 8);
 				bn_add_dig(m, m, 0x01);
 				/* Make room for the real message. */
 				bn_lsh(m, m, m_len * 8);
+				result = RLC_OK;
 				break;
 			case RSA_ENC_FIN:
 				/* EB = 00 | maskedSeed | maskedDB. */
 				rand_bytes(h1, RLC_MD_LEN);
 				md_mgf(mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN);
@@ -461,59 +462,57 @@ static int pad_pkcs2(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				}
 				bn_read_bin(t, h1, RLC_MD_LEN);
 				bn_lsh(t, t, 8 * (k_len - RLC_MD_LEN - 1));
 				bn_add(t, t, m);
 				bn_copy(m, t);
+				result = RLC_OK;
 				break;
 			case RSA_DEC:
 				m_len = k_len - 1;
 				bn_rsh(t, m, 8 * m_len);
-				if (!bn_is_zero(t)) {
-					result = RLC_ERR;
-				}
-				m_len -= RLC_MD_LEN;
-				bn_rsh(t, m, 8 * m_len);
-				bn_write_bin(h1, RLC_MD_LEN, t);
-				bn_mod_2b(m, m, 8 * m_len);
-				bn_write_bin(mask, m_len, m);
-				md_mgf(h2, RLC_MD_LEN, mask, m_len);
-				for (int i = 0; i < RLC_MD_LEN; i++) {
-					h1[i] ^= h2[i];
-				}
-				md_mgf(mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN);
-				bn_read_bin(t, mask, k_len - RLC_MD_LEN - 1);
-				for (int i = 0; i < t->used; i++) {
-					m->dp[i] ^= t->dp[i];
-				}
-				m_len -= RLC_MD_LEN;
-				bn_rsh(t, m, 8 * m_len);
-				bn_write_bin(h2, RLC_MD_LEN, t);
-				md_map(h1, NULL, 0);
-				pad = 0;
-				for (int i = 0; i < RLC_MD_LEN; i++) {
-					pad |= h1[i] - h2[i];
-				}
-				if (result == RLC_OK) {
-					result = (pad ? RLC_ERR : RLC_OK);
-				}
-				bn_mod_2b(m, m, 8 * m_len);
-				*p_len = bn_size_bin(m);
-				(*p_len)--;
-				bn_rsh(t, m, *p_len * 8);
-				if (bn_cmp_dig(t, 1) != RLC_EQ) {
-					result = RLC_ERR;
+				if (bn_is_zero(t)) {
+					m_len -= RLC_MD_LEN;
+					bn_rsh(t, m, 8 * m_len);
+					bn_write_bin(h1, RLC_MD_LEN, t);
+					bn_mod_2b(m, m, 8 * m_len);
+					bn_write_bin(mask, m_len, m);
+					md_mgf(h2, RLC_MD_LEN, mask, m_len);
+					for (int i = 0; i < RLC_MD_LEN; i++) {
+						h1[i] ^= h2[i];
+					}
+					md_mgf(mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN);
+					bn_read_bin(t, mask, k_len - RLC_MD_LEN - 1);
+					for (int i = 0; i < t->used; i++) {
+						m->dp[i] ^= t->dp[i];
+					}
+					m_len -= RLC_MD_LEN;
+					bn_rsh(t, m, 8 * m_len);
+					bn_write_bin(h2, RLC_MD_LEN, t);
+					md_map(h1, NULL, 0);
+					pad = 0;
+					for (int i = 0; i < RLC_MD_LEN; i++) {
+						pad |= h1[i] ^ h2[i];
+					}
+					bn_mod_2b(m, m, 8 * m_len);
+					*p_len = bn_size_bin(m);
+					(*p_len)--;
+					bn_rsh(t, m, *p_len * 8);
+					if (pad == 0 && bn_cmp_dig(t, 1) == RLC_EQ) {
+						result = RLC_OK;
+					}
+					bn_mod_2b(m, m, *p_len * 8);
+					*p_len = k_len - *p_len;
 				}
-				bn_mod_2b(m, m, *p_len * 8);
-				*p_len = k_len - *p_len;
 				break;
 			case RSA_SIG:
 			case RSA_SIG_HASH:
 				/* M' = 00 00 00 00 00 00 00 00 | H(M). */
 				bn_zero(m);
 				bn_lsh(m, m, 64);
 				/* Make room for the real message. */
 				bn_lsh(m, m, RLC_MD_LEN * 8);
+				result = RLC_OK;
 				break;
 			case RSA_SIG_FIN:
 				memset(mask, 0, 8);
 				bn_write_bin(mask + 8, RLC_MD_LEN, m);
 				md_map(h1, mask, RLC_MD_LEN + 8);
@@ -527,20 +526,21 @@ static int pad_pkcs2(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 				bn_lsh(m, m, 8);
 				bn_add_dig(m, m, RSA_PSS);
 				for (int i = m_len - 1; i < 8 * k_len; i++) {
 					bn_set_bit(m, i, 0);
 				}
+				result = RLC_OK;
 				break;
 			case RSA_VER:
 			case RSA_VER_HASH:
 				bn_mod_2b(t, m, 8);
-				if (bn_cmp_dig(t, RSA_PSS) != RLC_EQ) {
-					result = RLC_ERR;
-				} else {
+				pad = (uint8_t)t->dp[0];
+				if (pad == RSA_PSS) {
+					int r = 1;
 					for (int i = m_len; i < 8 * k_len; i++) {
 						if (bn_get_bit(m, i) != 0) {
-							result = RLC_ERR;
+							r = 0;
 						}
 					}
 					bn_rsh(m, m, 8);
 					bn_mod_2b(t, m, 8 * RLC_MD_LEN);
 					bn_write_bin(h2, RLC_MD_LEN, t);
@@ -553,12 +553,12 @@ static int pad_pkcs2(bn_t m, int *p_len, int m_len, int k_len, int operation) {
 					}
 					m->dp[0] ^= 0x01;
 					for (int i = m_len - 1; i < 8 * k_len; i++) {
 						bn_set_bit(m, i - ((RLC_MD_LEN + 1) * 8), 0);
 					}
-					if (!bn_is_zero(m)) {
-						result = RLC_ERR;
+					if (r == 1 && bn_is_zero(m)) {
+						result = RLC_OK;
 					}
 					bn_read_bin(m, h2, RLC_MD_LEN);
 					*p_len = k_len - RLC_MD_LEN;
 				}
 				break;

Vulnerable code: 	int result = RLC_OK;
				if (!bn_is_zero(t)) {
					result = RLC_ERR;
				}
				*p_len = 1;
				do {
					(*p_len)++;
					m_len--;
					bn_rsh(t, m, 8 * m_len);
					pad = (uint8_t)t->dp[0];
				} while (pad == 0 && m_len > 0);
				if (pad != RSA_PAD) {
					result = RLC_ERR;
				bn_mod_2b(m, m, (k_len - *p_len) * 8);
	int len, result = RLC_OK;
				if (!bn_is_zero(t)) {
					result = RLC_ERR;
				}

				*p_len = m_len;
				m_len--;
				bn_rsh(t, m, 8 * m_len);
				pad = (uint8_t)t->dp[0];
				if (pad != RSA_PUB) {
					result = RLC_ERR;
				}
				do {
				} while (pad != 0 && m_len > 0);
				/* Remove padding and trailing zero. */
				*p_len -= (m_len - 1);
				bn_mod_2b(m, m, (k_len - *p_len) * 8);
				if (!bn_is_zero(t)) {
					result = RLC_ERR;
				}
				m_len--;
				bn_rsh(t, m, 8 * m_len);
				pad = (uint8_t)t->dp[0];
				if (pad != RSA_PRV) {
					result = RLC_ERR;
				}
				do {
				} while (pad != 0 && m_len > 0);
				if (m_len == 0) {
					result = RLC_ERR;
				}
				/* Remove padding and trailing zero. */
				id = hash_id(MD_MAP, &len);
				m_len -= len;

				bn_rsh(t, m, m_len * 8);
				int r = 0;
				for (int i = 0; i < len; i++) {
					pad = (uint8_t)t->dp[0];
					r |= pad - id[len - i - 1];
					bn_rsh(t, t, 8);
				*p_len = k_len - m_len;
				bn_mod_2b(m, m, m_len * 8);
				result = (r == 0 ? RLC_OK : RLC_ERR);
				if (!bn_is_zero(t)) {
					result = RLC_ERR;
				}
				m_len--;
				bn_rsh(t, m, 8 * m_len);
				pad = (uint8_t)t->dp[0];
				if (pad != RSA_PRV) {
					result = RLC_ERR;
				}
				do {
				} while (pad != 0 && m_len > 0);
				if (m_len == 0) {
					result = RLC_ERR;
				/* Remove padding and trailing zero. */
				*p_len = k_len - m_len;
				bn_mod_2b(m, m, m_len * 8);
	int result = RLC_OK;
				if (!bn_is_zero(t)) {
					result = RLC_ERR;
				}
				m_len -= RLC_MD_LEN;
				bn_rsh(t, m, 8 * m_len);
				bn_write_bin(h1, RLC_MD_LEN, t);
				bn_mod_2b(m, m, 8 * m_len);
				bn_write_bin(mask, m_len, m);
				md_mgf(h2, RLC_MD_LEN, mask, m_len);
				for (int i = 0; i < RLC_MD_LEN; i++) {
					h1[i] ^= h2[i];
				}
				md_mgf(mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN);
				bn_read_bin(t, mask, k_len - RLC_MD_LEN - 1);
				for (int i = 0; i < t->used; i++) {
					m->dp[i] ^= t->dp[i];
				}
				m_len -= RLC_MD_LEN;
				bn_rsh(t, m, 8 * m_len);
				bn_write_bin(h2, RLC_MD_LEN, t);
				md_map(h1, NULL, 0);
				pad = 0;
				for (int i = 0; i < RLC_MD_LEN; i++) {
					pad |= h1[i] - h2[i];
				}
				if (result == RLC_OK) {
					result = (pad ? RLC_ERR : RLC_OK);
				}
				bn_mod_2b(m, m, 8 * m_len);
				*p_len = bn_size_bin(m);
				(*p_len)--;
				bn_rsh(t, m, *p_len * 8);
				if (bn_cmp_dig(t, 1) != RLC_EQ) {
					result = RLC_ERR;
				bn_mod_2b(m, m, *p_len * 8);
				*p_len = k_len - *p_len;
				if (bn_cmp_dig(t, RSA_PSS) != RLC_EQ) {
					result = RLC_ERR;
				} else {
							result = RLC_ERR;
					if (!bn_is_zero(m)) {
						result = RLC_ERR;
Fixed code: 	int result = RLC_ERR;
				result = RLC_OK;
				if (bn_is_zero(t)) {
					*p_len = 1;
					do {
						(*p_len)++;
						m_len--;
						bn_rsh(t, m, 8 * m_len);
						pad = (uint8_t)t->dp[0];
					} while (pad == 0 && m_len > 0);
					if (pad == RSA_PAD) {
						result = RLC_OK;
					}
					bn_mod_2b(m, m, (k_len - *p_len) * 8);
	int len, result = RLC_ERR;
				result = RLC_OK;
				if (bn_is_zero(t)) {
					*p_len = m_len;
					if (pad == RSA_PUB) {
						do {
							m_len--;
							bn_rsh(t, m, 8 * m_len);
							pad = (uint8_t)t->dp[0];
						} while (pad != 0 && m_len > 0);
						/* Remove padding and trailing zero. */
						*p_len -= (m_len - 1);
						bn_mod_2b(m, m, (k_len - *p_len) * 8);
						result = (m_len > 0 ? RLC_OK : RLC_ERR);
					}
				}
				result = RLC_OK;
				result = RLC_OK;
				if (bn_is_zero(t)) {
					if (pad == RSA_PRV) {
						int counter = 0;
						do {
							counter++;
							m_len--;
							bn_rsh(t, m, 8 * m_len);
							pad = (uint8_t)t->dp[0];
						} while (pad == RSA_PAD && m_len > 0);
						/* Remove padding and trailing zero. */
						id = hash_id(MD_MAP, &len);
						m_len -= len;

						bn_rsh(t, m, m_len * 8);
						int r = 0;
						for (int i = 0; i < len; i++) {
							pad = (uint8_t)t->dp[0];
							r |= pad ^ id[len - i - 1];
							bn_rsh(t, t, 8);
						}
						*p_len = k_len - m_len;
						bn_mod_2b(m, m, m_len * 8);
						if (r && m_len > 0 && counter >= 8) {
							result = RLC_OK;
						}
					}
				if (bn_is_zero(t)) {
					if (pad == RSA_PRV) {
						int counter = 0;
						do {
							counter++;
							m_len--;
							bn_rsh(t, m, 8 * m_len);
							pad = (uint8_t)t->dp[0];
						} while (pad == RSA_PAD && m_len > 0);
						/* Remove padding and trailing zero. */
						*p_len = k_len - m_len;
						bn_mod_2b(m, m, m_len * 8);
						if (m_len > 0 && counter >= 8) {
							result = RLC_OK;
						}
					}
	int result = RLC_ERR;
				result = RLC_OK;
				result = RLC_OK;
				if (bn_is_zero(t)) {
					m_len -= RLC_MD_LEN;
					bn_rsh(t, m, 8 * m_len);
					bn_write_bin(h1, RLC_MD_LEN, t);
					bn_mod_2b(m, m, 8 * m_len);
					bn_write_bin(mask, m_len, m);
					md_mgf(h2, RLC_MD_LEN, mask, m_len);
					for (int i = 0; i < RLC_MD_LEN; i++) {
						h1[i] ^= h2[i];
					}
					md_mgf(mask, k_len - RLC_MD_LEN - 1, h1, RLC_MD_LEN);
					bn_read_bin(t, mask, k_len - RLC_MD_LEN - 1);
					for (int i = 0; i < t->used; i++) {
						m->dp[i] ^= t->dp[i];
					}
					m_len -= RLC_MD_LEN;
					bn_rsh(t, m, 8 * m_len);
					bn_write_bin(h2, RLC_MD_LEN, t);
					md_map(h1, NULL, 0);
					pad = 0;
					for (int i = 0; i < RLC_MD_LEN; i++) {
						pad |= h1[i] ^ h2[i];
					}
					bn_mod_2b(m, m, 8 * m_len);
					*p_len = bn_size_bin(m);
					(*p_len)--;
					bn_rsh(t, m, *p_len * 8);
					if (pad == 0 && bn_cmp_dig(t, 1) == RLC_EQ) {
						result = RLC_OK;
					}
					bn_mod_2b(m, m, *p_len * 8);
					*p_len = k_len - *p_len;
				result = RLC_OK;
				result = RLC_OK;
				pad = (uint8_t)t->dp[0];
				if (pad == RSA_PSS) {
					int r = 1;
							r = 0;
					if (r == 1 && bn_is_zero(m)) {
						result = RLC_OK;