Struct Rs256Verify 

pub struct Rs256Verify {
    pub message: ByteVec,
    pub signature: ByteVec,
    pub modulus: ByteVec,
    pub rsa_intermediates: RsaIntermediates,
}

RS256 signature verification circuit (internal implementation)

This circuit verifies a signature for a given message according to the signature verification algorithm RSASSA-PKCS1-v1_5, using SHA-256 as a hash.

This signature verification algorithm is used in JWT signatures which have the “alg” header set to “RS256”. https://datatracker.ietf.org/doc/html/rfc7518#section-3.1

Fields

message: ByteVec

The message to verify (packed as 64-bit words, 8 bytes per wire)

signature: ByteVec

The RSA signature as a FixedByteVec (the primary input interface)

modulus: ByteVec

The RSA modulus as a FixedByteVec (the primary input interface)

rsa_intermediates: RsaIntermediates

Wires associated with intermediate RSA computations

Implementations

impl Rs256Verify

pub fn new( builder: &mut CircuitBuilder, message: ByteVec, signature: ByteVec, modulus: ByteVec, ) -> Self

Create a new RS256 verification circuit

This constructor accepts inputs with little-endian wire packing, which is convenient when composing with other circuits (e.g base64, concat) which use the same wire packing.

RS256 uses the public exponent 2^16 + 1 (65537). The circuit verifies that the encoded message (EM) has the following properties:

• signature < modulus
• EM = signature^65537 mod modulus
• EM has a valid PKCS#1 v1.5 prefix
• The hash stored in EM is equal to the SHA-256 hash of the provided message.

Arguments

• builder - Circuit builder
• message - A FixedByteVec containing the plaintext message
• signature - The RSA signature with little-endian wire packing (256 bytes for 2048-bit RSA)
• modulus - The RSA modulus with little-endian wire packing (256 bytes for 2048-bit RSA)

Panics

• If signature or modulus don’t have at least 256 bytes

pub fn populate_len_bytes(&self, w: &mut WitnessFiller<'_>, len_bytes: usize)

Populate the message length

pub fn populate_rsa( &self, w: &mut WitnessFiller<'_>, signature: &[u8], modulus: &[u8], )

Populate the RSA signature, modulus and intermediate computations

pub fn populate_intermediates( &self, w: &mut WitnessFiller<'_>, signature: &[u8], modulus: &[u8], )

pub fn populate_message(&self, w: &mut WitnessFiller<'_>, message: &[u8])

Populate the message

Panics

Panics if message.len() > self.message.len() * 8

pub fn populate_modulus(&self, w: &mut WitnessFiller<'_>, modulus_bytes: &[u8])

Populate the RSA modulus

Panics

Panics if modulus_bytes.len() != 256

pub fn populate_signature( &self, w: &mut WitnessFiller<'_>, signature_bytes: &[u8], )

Populate the RSA signature

Arguments

• w - Witness filler
• signature_bytes - The bytes of an RSA signature

Panics

Panics if signature_bytes.len() != 256