@ttsc/win32-arm64 0.33.1 → 0.34.0

package/bin/go/src/crypto/internal/fips140/rsa/keygen.go

@@ -14,6 +14,13 @@ import (
 
 // GenerateKey generates a new RSA key pair of the given bit size.
 // bits must be at least 32.
+//
+// It follows the process described at c2sp.org/det-keygen, which is compliant
+// with FIPS 186-5, Appendix A.1, IFC Key Pair Generation and FIPS 186-5,
+// Appendix A.1.3, Generation of Random Primes that are Probably Prime.
+// The prime candidates are drawn from rand, which in production will be the
+// global DRBG, while in tests can be an HMAC_DRBG as specified in
+// c2sp.org/det-keygen, to allow using its tests vectors.
 func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
 	if bits < 32 {
 		return nil, errors.New("rsa: key too small")
@@ -61,11 +68,11 @@ func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
 		// However, FIPS 186-5, A.1.1(3) requires computing it as e⁻¹ mod λ(N)
 		// where λ(N) = lcm(p-1, q-1).
 		//
-		// This makes d smaller by 1.5 bits on average, which is irrelevant both
+		// This makes d smaller by 1.82 bits on average, which is irrelevant both
 		// because we exclusively use the CRT for private operations and because
 		// we use constant time windowed exponentiation. On the other hand, it
-		// requires computing a GCD of two values that are not coprime, and then
-		// a division, both complex variable-time operations.
+		// requires computing a GCD of two even numbers, and then a division,
+		// both complex variable-time operations.
 		λ, err := totient(P, Q)
 		if err == errDivisorTooLarge {
 			// The divisor is too large, try again with different primes.
@@ -84,7 +91,7 @@ func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
 			//
 			// We waste a prime by retrying the whole process, since 65537 is
 			// probably only a factor of one of p-1 or q-1, but the probability
-			// of this check failing is only 1/65537, so it doesn't matter.
+			// of this check failing is ≈ 2⁻¹⁵, so it doesn't matter.
 			continue
 		}
 
@@ -97,9 +104,9 @@ func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
 		// The probability of this check failing when d is derived from
 		// (e, p, q) is roughly
 		//
-		//   2^(nlen/2) / 2^nlen = 2^(-nlen/2)
+		//   2^(nlen/2) / λ(N) ≈ 2^(-nlen/2 + 1.82)
 		//
-		// so less than 2⁻¹²⁸ for keys larger than 256 bits.
+		// so less than 2⁻¹²⁶ for keys larger than 256 bits.
 		//
 		// We still need to check to comply with FIPS 186-5, but knowing it has
 		// negligible chance of failure we can defer the check to the end of key
@@ -134,20 +141,27 @@ func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
 var errDivisorTooLarge = errors.New("divisor too large")
 
 // totient computes the Carmichael totient function λ(N) = lcm(p-1, q-1).
+//
+// p and q must be primes congruent to 7 mod 8, so that p-1 and q-1 are both
+// even but not divisible by 4.
+//
+// totient returns errDivisorTooLarge if GCD(p-1, q-1) is larger than 2³²-1.
 func totient(p, q *bigmod.Modulus) (*bigmod.Modulus, error) {
 	a, b := p.Nat().SubOne(p), q.Nat().SubOne(q)
+	if a.IsOdd() == 1 || b.IsOdd() == 1 {
+		return nil, errors.New("rsa: internal error: p and q must be 7 mod 8")
+	}
 
 	// lcm(a, b) = a×b / gcd(a, b) = a × (b / gcd(a, b))
 
-	// Our GCD requires at least one of the numbers to be odd. For LCM we only
-	// need to preserve the larger prime power of each prime factor, so we can
-	// right-shift the number with the fewest trailing zeros until it's odd.
-	// For odd a, b and m >= n, lcm(a×2ᵐ, b×2ⁿ) = lcm(a×2ᵐ, b).
-	az, bz := a.TrailingZeroBitsVarTime(), b.TrailingZeroBitsVarTime()
-	if az < bz {
-		a = a.ShiftRightVarTime(az)
-	} else {
-		b = b.ShiftRightVarTime(bz)
+	// Our GCD requires at least one of the numbers to be odd.
+	// We know that a / 2 and b / 2 are odd because p and q are 7 mod 8.
+	// For LCM we only need to preserve the larger prime power of each
+	// prime factor, so we can shift out 2 from either of them.
+	// For odd x, y and m >= n, lcm(x×2, y×2) = lcm(x×2, y).
+	b = b.ShiftRightByOne()
+	if b.IsOdd() == 0 {
+		return nil, errors.New("rsa: internal error: p and q must be 7 mod 8")
 	}
 
 	gcd, err := bigmod.NewNat().GCDVarTime(a, b)
@@ -160,10 +174,11 @@ func totient(p, q *bigmod.Modulus) (*bigmod.Modulus, error) {
 
 	// To avoid implementing multiple-precision division, we just try again if
 	// the divisor doesn't fit in a single word. This would have a chance of
-	// 2⁻⁶⁴ on 64-bit platforms, and 2⁻³² on 32-bit platforms, but testing 2⁻⁶⁴
-	// edge cases is impractical, and we'd rather not behave differently on
-	// different platforms, so we reject divisors above 2³²-1.
-	if gcd.BitLenVarTime() > 32 {
+	// ~2⁻⁶⁴ on 64-bit platforms, and ~2⁻³² on 32-bit platforms, but testing
+	// 2⁻⁶⁴ edge cases is impractical, and we'd rather not behave differently on
+	// different platforms, so we reject divisors above 2³²-1. Note that we also
+	// add back the factor of 2 we shifted out above.
+	if gcd.BitLenVarTime()+1 > 32 {
 		return nil, errDivisorTooLarge
 	}
 	if gcd.IsZero() == 1 || gcd.Bits()[0] == 0 {
@@ -205,8 +220,10 @@ func randomPrime(rand io.Reader, bits int) ([]byte, error) {
 			b[1] |= 0b1000_0000
 		}
 
-		// Make the value odd since an even number certainly isn't prime.
-		b[len(b)-1] |= 1
+		// Set the three least significant bits, which makes the value 7 mod 8
+		// (steps 4.3 and 5.3). Even numbers are not prime, and an odd
+		// (p - 1) / 2 simplifies [millerRabinIteration] and the GCD in [totient].
+		b[len(b)-1] |= 0b0000_0111
 
 		// We don't need to check for p >= √2 × 2^(bits-1) (steps 4.4 and 5.4)
 		// because we set the top two bits above, so
@@ -233,7 +250,7 @@ func randomPrime(rand io.Reader, bits int) ([]byte, error) {
 // isPrime runs the Miller-Rabin Probabilistic Primality Test from
 // FIPS 186-5, Appendix B.3.1.
 //
-// w must be a random odd integer greater than three in big-endian order.
+// w must be a random integer equal to 3 mod 4 in big-endian order.
 // isPrime might return false positives for adversarially chosen values.
 //
 // isPrime is not constant-time.
@@ -339,35 +356,32 @@ var primes = []uint{
 
 type millerRabin struct {
 	w *bigmod.Modulus
-	a uint
 	m []byte
 }
 
 // millerRabinSetup prepares state that's reused across multiple iterations of
 // the Miller-Rabin test.
+//
+// w must be a random integer equal to 3 mod 4 in big-endian order.
 func millerRabinSetup(w []byte) (*millerRabin, error) {
 	mr := &millerRabin{}
 
-	// Check that w is odd, and precompute Montgomery parameters.
+	// Check that w is 3 mod 4, and precompute Montgomery parameters.
+	if len(w) == 0 || w[len(w)-1]&0b11 != 0b11 {
+		return nil, errors.New("candidate is not 3 mod 4")
+	}
 	wm, err := bigmod.NewModulus(w)
 	if err != nil {
 		return nil, err
 	}
-	if wm.Nat().IsOdd() == 0 {
-		return nil, errors.New("candidate is even")
-	}
 	mr.w = wm
 
 	// Compute m = (w-1)/2^a, where m is odd.
-	wMinus1 := mr.w.Nat().SubOne(mr.w)
-	if wMinus1.IsZero() == 1 {
-		return nil, errors.New("candidate is one")
-	}
-	mr.a = wMinus1.TrailingZeroBitsVarTime()
+	// Since w is 3 mod 4, a is always 1, so m = (w-1)/2.
+	m := mr.w.Nat().SubOne(mr.w).ShiftRightByOne()
 
 	// Store mr.m as a big-endian byte slice with leading zero bytes removed,
 	// for use with [bigmod.Nat.Exp].
-	m := wMinus1.ShiftRightVarTime(mr.a)
 	mr.m = m.Bytes(mr.w)
 	for mr.m[0] == 0 {
 		mr.m = mr.m[1:]
@@ -397,23 +411,11 @@ func millerRabinIteration(mr *millerRabin, bb []byte) (bool, error) {
 	// If b^(m*2^i) mod w = -1 for some 0 <= i < a, b is a possible prime.
 	// Otherwise b is composite.
 
-	// Start by computing and checking b^m mod w (also the i = 0 case).
+	// Since a = 1 for our w, we only need to check b^m mod w = +/-1.
 	z := bigmod.NewNat().Exp(b, mr.m, mr.w)
 	if z.IsOne() == 1 || z.IsMinusOne(mr.w) == 1 {
 		return millerRabinPOSSIBLYPRIME, nil
 	}
 
-	// Check b^(m*2^i) mod w = -1 for 0 < i < a.
-	for range mr.a - 1 {
-		z.Mul(z, mr.w)
-		if z.IsMinusOne(mr.w) == 1 {
-			return millerRabinPOSSIBLYPRIME, nil
-		}
-		if z.IsOne() == 1 {
-			// Future squaring will not turn z == 1 into -1.
-			break
-		}
-	}
-
 	return millerRabinCOMPOSITE, nil
 }

package/bin/go/src/crypto/internal/fips140/rsa/largeexponent.go

@@ -0,0 +1,365 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package rsa
+
+import (
+	"bytes"
+	"crypto/internal/constanttime"
+	"crypto/internal/fips140"
+	"crypto/internal/fips140/bigmod"
+	"crypto/internal/fips140/drbg"
+	"crypto/internal/fips140/subtle"
+	"errors"
+	"hash"
+	"io"
+)
+
+// TestingOnlyLargeExponentPublicKey is a variant of [PublicKey] that supports
+// large public exponents. It is only meant for supporting the full ACVP test
+// suite, which unfortunately forces us to choose between a fixed exponent and
+// the full (2¹⁶, 2²⁵⁶) range. This type must not be used in production code,
+// nor for e values < 2³¹, which instead must use [PublicKey].
+type TestingOnlyLargeExponentPublicKey struct {
+	N *bigmod.Modulus
+	// E is the public exponent, represented as a big-endian byte slice.
+	E []byte
+}
+
+func (pub *TestingOnlyLargeExponentPublicKey) Size() int {
+	return (pub.N.BitLen() + 7) / 8
+}
+
+func checkLargeExponentPublicKey(pub *TestingOnlyLargeExponentPublicKey) error {
+	if pub.N == nil {
+		return errors.New("crypto/rsa: missing public modulus")
+	}
+	if pub.N.Nat().IsOdd() == 0 {
+		return errors.New("crypto/rsa: public modulus is even")
+	}
+	if pub.N.BitLen() < 2048 {
+		return errors.New("crypto/rsa: public modulus too small")
+	}
+	if pub.N.BitLen()%2 == 1 {
+		return errors.New("crypto/rsa: public modulus bit length not even")
+	}
+	E := pub.E
+	for len(E) > 0 && E[0] == 0 {
+		E = E[1:]
+	}
+	if len(E) < 32/8 || (len(E) == 32/8 && E[0] < 0x80) {
+		// Exponents less than 2^31 must use [PublicKey].
+		return errors.New("crypto/rsa: public exponent too small")
+	}
+	if len(E) > 256/8 {
+		return errors.New("crypto/rsa: public exponent too large")
+	}
+	if E[len(E)-1]&1 == 0 {
+		return errors.New("crypto/rsa: public exponent is even")
+	}
+	return nil
+}
+
+func encryptLargeExponent(pub *TestingOnlyLargeExponentPublicKey, plaintext []byte) ([]byte, error) {
+	m, err := bigmod.NewNat().SetBytes(plaintext, pub.N)
+	if err != nil {
+		return nil, err
+	}
+	return bigmod.NewNat().Exp(m, pub.E, pub.N).Bytes(pub.N), nil
+}
+
+func TestingOnlyLargeExponentVerifyPKCS1v15(pub *TestingOnlyLargeExponentPublicKey, hash string, hashed []byte, sig []byte) error {
+	fipsSelfTest()
+	fips140.RecordApproved()
+	checkApprovedHashName(hash)
+	if err := checkLargeExponentPublicKey(pub); err != nil {
+		return err
+	}
+	if pub.Size() != len(sig) {
+		return ErrVerification
+	}
+	em, err := encryptLargeExponent(pub, sig)
+	if err != nil {
+		return ErrVerification
+	}
+	expected, err := pkcs1v15ConstructEM(&PublicKey{N: pub.N}, hash, hashed)
+	if err != nil {
+		return ErrVerification
+	}
+	if !bytes.Equal(em, expected) {
+		return ErrVerification
+	}
+	return nil
+}
+
+func TestingOnlyLargeExponentVerifyPSS(pub *TestingOnlyLargeExponentPublicKey, hash hash.Hash, digest []byte, sig []byte) error {
+	fipsSelfTest()
+	fips140.RecordApproved()
+	checkApprovedHash(hash)
+	if err := checkLargeExponentPublicKey(pub); err != nil {
+		return err
+	}
+	if len(sig) != pub.Size() {
+		return ErrVerification
+	}
+	emBits := pub.N.BitLen() - 1
+	emLen := (emBits + 7) / 8
+	em, err := encryptLargeExponent(pub, sig)
+	if err != nil {
+		return ErrVerification
+	}
+	for len(em) > emLen && len(em) > 0 {
+		if em[0] != 0 {
+			return ErrVerification
+		}
+		em = em[1:]
+	}
+	return emsaPSSVerify(digest, em, emBits, pssSaltLengthAutodetect, hash)
+}
+
+// TestingOnlyLargeExponentPrivateKey is a variant of [PrivateKey] that supports
+// large public exponents. It is only meant for supporting the full ACVP test
+// suite. This type must not be used in production code.
+type TestingOnlyLargeExponentPrivateKey struct {
+	n    *bigmod.Modulus
+	e    []byte // big-endian public exponent
+	d    *bigmod.Nat
+	p, q *bigmod.Modulus
+	dP   []byte
+	dQ   []byte
+	qInv *bigmod.Nat
+}
+
+func (priv *TestingOnlyLargeExponentPrivateKey) Size() int {
+	return (priv.n.BitLen() + 7) / 8
+}
+
+// TestingOnlyNewLargeExponentPrivateKeyWithPrecomputation creates a new RSA private key
+// with a large public exponent from the given parameters. It is only meant for ACVP testing.
+func TestingOnlyNewLargeExponentPrivateKeyWithPrecomputation(N []byte, e []byte, d, P, Q, dP, dQ, qInv []byte) (*TestingOnlyLargeExponentPrivateKey, error) {
+	n, err := bigmod.NewModulus(N)
+	if err != nil {
+		return nil, err
+	}
+	p, err := bigmod.NewModulus(P)
+	if err != nil {
+		return nil, err
+	}
+	q, err := bigmod.NewModulus(Q)
+	if err != nil {
+		return nil, err
+	}
+	dN, err := bigmod.NewNat().SetBytes(d, n)
+	if err != nil {
+		return nil, err
+	}
+	qInvNat, err := bigmod.NewNat().SetBytes(qInv, p)
+	if err != nil {
+		return nil, err
+	}
+
+	priv := &TestingOnlyLargeExponentPrivateKey{
+		n: n, e: e, d: dN, p: p, q: q,
+		dP: dP, dQ: dQ, qInv: qInvNat,
+	}
+	if err := checkLargeExponentPrivateKey(priv); err != nil {
+		return nil, err
+	}
+	return priv, nil
+}
+
+func checkLargeExponentPrivateKey(priv *TestingOnlyLargeExponentPrivateKey) error {
+	// Check public key portion.
+	pub := &TestingOnlyLargeExponentPublicKey{N: priv.n, E: priv.e}
+	if err := checkLargeExponentPublicKey(pub); err != nil {
+		return err
+	}
+
+	N := priv.n
+	p := priv.p
+	q := priv.q
+
+	// FIPS 186-5, Section 5.1 requires "that p and q be of the same bit length."
+	if p.BitLen() != q.BitLen() {
+		// We don't enforce this for testing, just note it.
+	}
+
+	// Check that pq ≡ 1 mod N (and that p < N and q < N).
+	pN := bigmod.NewNat().ExpandFor(N)
+	if _, err := pN.SetBytes(p.Nat().Bytes(p), N); err != nil {
+		return errors.New("crypto/rsa: invalid prime")
+	}
+	qN := bigmod.NewNat().ExpandFor(N)
+	if _, err := qN.SetBytes(q.Nat().Bytes(q), N); err != nil {
+		return errors.New("crypto/rsa: invalid prime")
+	}
+	if pN.Mul(qN, N).IsZero() != 1 {
+		return errors.New("crypto/rsa: p * q != n")
+	}
+
+	// Check that de ≡ 1 mod p-1, and de ≡ 1 mod q-1.
+	// Uses byte-slice exponent for large exponents.
+	pMinus1, err := bigmod.NewModulus(p.Nat().SubOne(p).Bytes(p))
+	if err != nil {
+		return errors.New("crypto/rsa: invalid prime")
+	}
+	dP, err := bigmod.NewNat().SetBytes(priv.dP, pMinus1)
+	if err != nil {
+		return errors.New("crypto/rsa: invalid CRT exponent")
+	}
+	de := bigmod.NewNat()
+	if _, err := de.SetBytes(priv.e, pMinus1); err != nil {
+		// Exponent might be larger than p-1, reduce it.
+		eNat, _ := bigmod.NewNat().SetBytes(priv.e, priv.n)
+		de.Mod(eNat, pMinus1)
+	}
+	de.Mul(dP, pMinus1)
+	if de.IsOne() != 1 {
+		return errors.New("crypto/rsa: invalid CRT exponent")
+	}
+
+	qMinus1, err := bigmod.NewModulus(q.Nat().SubOne(q).Bytes(q))
+	if err != nil {
+		return errors.New("crypto/rsa: invalid prime")
+	}
+	dQ, err := bigmod.NewNat().SetBytes(priv.dQ, qMinus1)
+	if err != nil {
+		return errors.New("crypto/rsa: invalid CRT exponent")
+	}
+	if _, err := de.SetBytes(priv.e, qMinus1); err != nil {
+		// Exponent might be larger than q-1, reduce it.
+		eNat, _ := bigmod.NewNat().SetBytes(priv.e, priv.n)
+		de.Mod(eNat, qMinus1)
+	}
+	de.Mul(dQ, qMinus1)
+	if de.IsOne() != 1 {
+		return errors.New("crypto/rsa: invalid CRT exponent")
+	}
+
+	// Check that qInv * q ≡ 1 mod p.
+	qP, err := bigmod.NewNat().SetOverflowingBytes(q.Nat().Bytes(q), p)
+	if err != nil {
+		// q >= 2^⌈log2(p)⌉
+		qP = bigmod.NewNat().Mod(q.Nat(), p)
+	}
+	if qP.Mul(priv.qInv, p).IsOne() != 1 {
+		return errors.New("crypto/rsa: invalid CRT coefficient")
+	}
+
+	return nil
+}
+
+func decryptLargeExponent(priv *TestingOnlyLargeExponentPrivateKey, ciphertext []byte) ([]byte, error) {
+	N := priv.n
+	c, err := bigmod.NewNat().SetBytes(ciphertext, N)
+	if err != nil {
+		return nil, ErrDecryption
+	}
+
+	// CRT-based decryption (same as regular decrypt, doesn't use E).
+	P, Q := priv.p, priv.q
+	t0 := bigmod.NewNat()
+	// m = c ^ Dp mod p
+	m := bigmod.NewNat().Exp(t0.Mod(c, P), priv.dP, P)
+	// m2 = c ^ Dq mod q
+	m2 := bigmod.NewNat().Exp(t0.Mod(c, Q), priv.dQ, Q)
+	// m = m - m2 mod p
+	m.Sub(t0.Mod(m2, P), P)
+	// m = m * Qinv mod p
+	m.Mul(priv.qInv, P)
+	// m = m * q mod N
+	m.ExpandFor(N).Mul(t0.Mod(Q.Nat(), N), N)
+	// m = m + m2 mod N
+	m.Add(m2.ExpandFor(N), N)
+
+	return m.Bytes(N), nil
+}
+
+// TestingOnlyLargeExponentDecryptOAEP decrypts ciphertext using RSAES-OAEP with
+// a private key that has a large public exponent. It is only meant for ACVP testing.
+func TestingOnlyLargeExponentDecryptOAEP(hash, mgfHash hash.Hash, priv *TestingOnlyLargeExponentPrivateKey, ciphertext []byte, label []byte) ([]byte, error) {
+	fipsSelfTest()
+	fips140.RecordApproved()
+	checkApprovedHash(hash)
+
+	k := priv.Size()
+	if len(ciphertext) > k || k < hash.Size()*2+2 {
+		return nil, ErrDecryption
+	}
+
+	em, err := decryptLargeExponent(priv, ciphertext)
+	if err != nil {
+		return nil, err
+	}
+
+	hash.Reset()
+	hash.Write(label)
+	lHash := hash.Sum(nil)
+
+	firstByteIsZero := constanttime.ByteEq(em[0], 0)
+
+	seed := em[1 : hash.Size()+1]
+	db := em[hash.Size()+1:]
+
+	mgf1XOR(seed, mgfHash, db)
+	mgf1XOR(db, mgfHash, seed)
+
+	lHash2 := db[0:hash.Size()]
+
+	lHash2Good := subtle.ConstantTimeCompare(lHash, lHash2)
+
+	var lookingForIndex, index, invalid int
+	lookingForIndex = 1
+	rest := db[hash.Size():]
+
+	for i := 0; i < len(rest); i++ {
+		equals0 := constanttime.ByteEq(rest[i], 0)
+		equals1 := constanttime.ByteEq(rest[i], 1)
+		index = constanttime.Select(lookingForIndex&equals1, i, index)
+		lookingForIndex = constanttime.Select(equals1, 0, lookingForIndex)
+		invalid = constanttime.Select(lookingForIndex&^equals0, 1, invalid)
+	}
+
+	if firstByteIsZero&lHash2Good&^invalid&^lookingForIndex != 1 {
+		return nil, ErrDecryption
+	}
+
+	return rest[index+1:], nil
+}
+
+// TestingOnlyLargeExponentEncryptOAEP encrypts the given message with RSAES-OAEP
+// using a public key with a large exponent. It is only meant for ACVP testing.
+func TestingOnlyLargeExponentEncryptOAEP(hash, mgfHash hash.Hash, random io.Reader, pub *TestingOnlyLargeExponentPublicKey, msg []byte, label []byte) ([]byte, error) {
+	fipsSelfTest()
+	fips140.RecordApproved()
+	checkApprovedHash(hash)
+	if err := checkLargeExponentPublicKey(pub); err != nil {
+		return nil, err
+	}
+	k := pub.Size()
+	if len(msg) > k-2*hash.Size()-2 {
+		return nil, ErrMessageTooLong
+	}
+
+	hash.Reset()
+	hash.Write(label)
+	lHash := hash.Sum(nil)
+
+	em := make([]byte, k)
+	seed := em[1 : 1+hash.Size()]
+	db := em[1+hash.Size():]
+
+	copy(db[0:hash.Size()], lHash)
+	db[len(db)-len(msg)-1] = 1
+	copy(db[len(db)-len(msg):], msg)
+
+	if err := drbg.ReadWithReader(random, seed); err != nil {
+		return nil, err
+	}
+
+	mgf1XOR(db, mgfHash, seed)
+	mgf1XOR(seed, mgfHash, db)
+
+	return encryptLargeExponent(pub, em)
+}

package/bin/go/src/crypto/internal/fips140/rsa/pkcs1v15.go

@@ -22,6 +22,9 @@ import (
 // For performance, we don't use the generic ASN1 encoder. Rather, we
 // precompute a prefix of the digest value that makes a valid ASN1 DER string
 // with the correct contents.
+//
+// For any new entry, also add the size to [hashSize], and if applicable, add
+// the hash name to [checkApprovedHashName].
 var hashPrefixes = map[string][]byte{
 	"MD5":         {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10},
 	"SHA-1":       {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14},
@@ -69,6 +72,9 @@ func pkcs1v15ConstructEM(pub *PublicKey, hash string, hashed []byte) ([]byte, er
 		if !ok {
 			return nil, errors.New("crypto/rsa: unsupported hash function")
 		}
+		if len(hashed) != hashSize(hash) {
+			return nil, errors.New("crypto/rsa: hashed message length does not match hash function")
+		}
 	}
 
 	// EM = 0x00 || 0x01 || PS || 0x00 || T
@@ -128,6 +134,27 @@ func verifyPKCS1v15(pub *PublicKey, hash string, hashed []byte, sig []byte) erro
 	return nil
 }
 
+func hashSize(hash string) int {
+	switch hash {
+	case "MD5":
+		return 16
+	case "SHA-1", "RIPEMD-160":
+		return 20
+	case "SHA-224", "SHA-512/224", "SHA3-224":
+		return 28
+	case "SHA-256", "SHA-512/256", "SHA3-256":
+		return 32
+	case "SHA-384", "SHA3-384":
+		return 48
+	case "SHA-512", "SHA3-512":
+		return 64
+	case "MD5+SHA1":
+		return 36
+	default:
+		return -1
+	}
+}
+
 func checkApprovedHashName(hash string) {
 	switch hash {
 	case "SHA-224", "SHA-256", "SHA-384", "SHA-512", "SHA-512/224", "SHA-512/256",

package/bin/go/src/crypto/internal/fips140/sha256/_asm/go.mod

@@ -1,4 +1,4 @@
-module crypto/sha256/_asm
+module crypto/internal/fips140/sha256/_asm
 
 go 1.24
 

package/bin/go/src/crypto/internal/fips140/sha3/_asm/go.mod

@@ -1,4 +1,4 @@
-module sha3/_asm
+module crypto/internal/fips140/sha3/_asm
 
 go 1.22
 

package/bin/go/src/crypto/internal/fips140/sha512/_asm/go.mod

@@ -1,4 +1,4 @@
-module crypto/sha512/_asm
+module crypto/internal/fips140/sha512/_asm
 
 go 1.24
 

package/bin/go/src/crypto/internal/fips140/subtle/constant_time.go

@@ -29,7 +29,7 @@ func ConstantTimeCompare(x, y []byte) int {
 }
 
 // ConstantTimeLessOrEqBytes returns 1 if x <= y and 0 otherwise. The comparison
-// is lexigraphical, or big-endian. The time taken is a function of the length of
+// is lexicographical, or big-endian. The time taken is a function of the length of
 // the slices and is independent of the contents. If the lengths of x and y do not
 // match it returns 0 immediately.
 func ConstantTimeLessOrEqBytes(x, y []byte) int {

package/bin/go/src/crypto/internal/fips140/subtle/xor_asm.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (amd64 || arm64 || ppc64 || ppc64le || riscv64) && !purego
+//go:build (amd64 || arm64 || ppc64 || ppc64le) && !purego
 
 package subtle
 

package/bin/go/src/crypto/internal/fips140/subtle/xor_riscv64.go

@@ -0,0 +1,18 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build riscv64 && !purego
+
+package subtle
+
+import (
+	"crypto/internal/fips140deps/cpu"
+)
+
+//go:noescape
+func xorBytesRISCV64(dst, a, b *byte, n int, hasV bool)
+
+func xorBytes(dst, a, b *byte, n int) {
+	xorBytesRISCV64(dst, a, b, n, cpu.RISCV64HasV)
+}