[Benoît Cortier (CBenoit)]

Format decoders such as SSH and PuTTY hold RSA private keys as n, e, d, p and q, while PKCS#8 also needs dP, dQ and qInv.

Add the picky-crypto-rsa-crt crate, which computes these parameters with constant-time crypto-bigint arithmetic and checks that the components are consistent before returning them: p and q are odd and at least 3, p * q = n, q is invertible modulo p, and e * dP and e * dQ are 1 modulo p - 1 and q - 1. Secret intermediates and outputs are zeroized. Known-answer and error tests use published Wycheproof keys.

[Benoît Cortier (CBenoit)]

Validation and notes for review.

• Net lines: +491 / -2 across 9 files (src/lib.rs 136, tests 99, vendored key constants 145, README 37, INTENT 24, CI 18).
• Local checks: cargo fmt --check, cargo clippy --locked --workspace --all-features --all-targets -D warnings, cargo test -p picky-crypto-rsa-crt (23 tests, debug and release), cargo hack check --feature-powerset, cargo +1.85 check -p picky-crypto-rsa-crt.
• Cargo.lock only gains the new package entry; no version changes.
• Vectors: testGroups[i].privateKey from C2SP Wycheproof at 12fd3aaf33eb5fa1f52e026912ee00c054f9d984 (1024 to 8192-bit keys, including 2688, 3104 and 4032 bits), copied verbatim and cited per constant. Error cases only substitute whole fields between cited keys.
• Callers in picky (SSH, PuTTY, generate_rsa) only pass two-prime keys.
• Not tested: empty n and n above MAX_MODULUS_LEN, since that would require constructed inputs.
• Limitation: crypto-bigint does not zeroize some internal temporaries (safegcd state, multiplication and division scratch); documented in the README.

Note

LLM-assisted content (no human feedback).

[Copilot]

🟡 Changes recommended

It violates the intent-file policy and does not enforce its advertised modulus-size limit.

3 open findings

• Enforce the advertised 16,384-bit limit · New
• Remove unauthorized intent file with conflicting invariants · New
• Add no-panic tests for invalid prime inputs · New

What changed in this PR

Adds a no_std crate for deriving and validating RSA CRT parameters using constant-time big-integer arithmetic.

Changes:

• Implements CRT completion with consistency checks and zeroized outputs.
• Adds Wycheproof-based tests and documentation.
• Integrates the crate into the workspace and CI.

File	Description
picky-crypto-rsa-crt/​src/​lib.rs	Implements CRT completion.
picky-crypto-rsa-crt/​tests/​crt.rs	Tests valid and invalid keys.
picky-crypto-rsa-crt/​tests/​support/​vectors.rs	Provides Wycheproof vectors.
picky-crypto-rsa-crt/​README.md	Documents behavior and limitations.
picky-crypto-rsa-crt/​INTENT.md	Adds proposed crate intent.
picky-crypto-rsa-crt/​Cargo.toml	Defines crate metadata and dependencies.
Cargo.toml	Registers the workspace member.
Cargo.lock	Locks the new crate dependencies.
.github/​workflows/​ci.yml	Adds MSRV and feature checks.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

The 16,384-bit boundary logic needs regression coverage for its special 2,049-byte cases.

1 open finding

• Add regression tests for maximum modulus length and sign-byte validation · New

3 resolved since last review

• Enforce the advertised 16,384-bit limit
• Add no-panic tests for invalid prime inputs
• Remove unauthorized intent file with conflicting invariants

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

The constant-time and zeroization guarantees are security-critical and warrant final human cryptographic review.

0 open findings

1 resolved since last review

• Add regression tests for maximum modulus length and sign-byte validation

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

The constant-time arithmetic and secret-zeroization guarantees warrant final human cryptographic review.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Cryptographic arithmetic, constant-time behavior, and zeroization guarantees warrant final human security review.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Constant-time RSA arithmetic and secret-zeroization guarantees warrant final human cryptographic review.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

New constant-time cryptographic arithmetic and secret-handling code warrants final human security review despite no confirmed defects.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Cryptographic constant-time and zeroization guarantees warrant final human review despite no concrete defect identified.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The swapped-prime test does not verify the computed coefficient’s defining modular-inverse relation.

0 open findings

Previously missed (1)

In code that hasn't changed since last review

Test q > p inverse correctness, not just coefficient length

picky-crypto-rsa-crt/​tests/​crt.rs:61

This is the only case exercising q > p, but it checks only the coefficient's length. Since complete_crt_params validates that an inverse exists rather than validating the returned coefficient, an incorrect reduction or inversion result would still pass this test. Verify the defining relation q × qInv ≡ 1 (mod p) for the swapped key.

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

New constant-time private-key arithmetic and zeroization guarantees warrant final human cryptographic review.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The security-sensitive constant-time big-integer implementation warrants final human cryptographic review despite no concrete defect found.

0 open findings

🧠 Review effort: Balanced