Micropython RSA functionality for RPi Pico Wireless

[sgbaird]

I'm having trouble finding an asymmetric public-private key system (e.g. RSA) implemented in MicroPython that's compatible with RPi Pico or Pico W and can achieve the functionality of python-rsa per the docs:

import rsa
(bob_pub, bob_priv) = rsa.newkeys(512)
message = 'hello Bob!'.encode('utf8')
crypto = rsa.encrypt(message, bob_pub)

import rsa
message = rsa.decrypt(crypto, bob_priv)
print(message.decode('utf8'))

Also, I wasn't able to get micropython-rsa-signing working. It seems to lack the required functionality described above artem-smotrakov/micropython-rsa-signing#2

Aside: Micropython's cryptolib is symmetric.

[dmazzella]

Take a look at ucrypto a library for elliptic curve cryptography via the module ufastecdsa

For RSA the necessary math is implemented, take a look at ucrypto_number_1.py, but I have not implemented an 'ufastrsa' package for now, if you have time for do it all help is welcome 😁

[git-n-pissed]

I'm looking for something similar to the OP, but looking through the ucrypto repo, I feel like I'm missing something, or possibly multiple somethings 😀

First, one of the seemingly important bits in the OP code example was the ability to use an already generated public/private key pair (generated from the ucrypto or elsewhere). I'm not seeing how that is possible, at least not with the files that exist in the ufastrsa directory.

Second, the example @sgbaird gave here does not seem to have built the entire ucrypto package, but since I wasn't seeing what I needed in the files from the ufastrsa directory, I tried to build it for the ESP32-S3. Unfortunately I'm getting a ton of errors (like 228,000) during the linking process, all similar to this:

tfm_mpi.c:(.text+0x24c99e): dangerous relocation: l32r: literal target out of range (try using text-section-literals): (.literal+0x55cec)

Any guidance would be appreciated.

[dmazzella]

@git-n-pissed Thank you for your interest in the project.

try latest version with asm optimizations disabled for easy build on unsupported asm platform (like esp32) and reduce code size

[git-n-pissed]

@git-n-pissed Thank you for your interest in the project.

try latest version with asm optimizations disabled for easy build on unsupported asm platform (like esp32) and reduce code size

I had them all disabled except RSA-512, but I'll try again tomorrow with it disabled as well.

Once I get this built, do easy to use functions like encrypt, decrypt, sign, and verify exist? Since I made my first post earlier I have adapted the adafruit_rsa to work in my project, but being a pure Python implementation, it is pretty slow when using keys of a size required to offer any real protection.

Update: Since I posted last night I did get the build working by disabling all the asm optimizations as suggested. I also found the pkcs_encrypt, pkcs_decrypt, pkcs_sign, and pkcs_verify functions right in the RSA class as I would have expected, and realized that I can specify the n, e, and d values of the RSA key in its constructor so I should be able to use already generated keys. Apparently I can't grep or analyze code when it is late 🤦 Also, no excuse since the functions were literally used in the example I linked to 🤦

Great work @dmazzella! Your documentation was helpful, but since this was my first go with a user C module in Micropython there are a few things that would have helped a bit.

First, it wasn't apparent to me that the files from the modules directory needed to be copied to the port's modules directory. Maybe that should have been obvious, but I was just thinking that the build process was going to figure it out some how. So a note about that would be helpful.

Second, once I realized that the modules hadn't been placed correctly, I also realized that ucrypto's manifest.py file would need to be included. I knew this because my project uses a custom manifest, but a note about that may be helpful for others.

Thanks again for your work on this!

[git-n-pissed]

@dmazzella , can you help me understand the signature schema being used? I have limited crypto experience, but other tools I've used like pycryptodome and python-rsa require a hashing algorithm to be specified (MD5, SHA1, SHA256, etc.), but the pkcs_sign function ultimately signs with a call to pow. I've never seen this before, so I'm trying to figure out what level of security I should expect. Also, how would I duplicate the signature schema being used in pkcs_sign and pkcs_verify using other RSA libraries/packages so messages can be signed/verified when passed between platforms?

[dmazzella]

@git-n-pissed thanks for taking the time to test the library.

the schema used for the signature is EME-PKCS1-v1_5(PKCS #1 v1.5, Section 8) , the libraries you mentioned pycryptodome and python-rsa use EMSA-PKCS1-v1_5.

if you need to implement the EMSA version it is not complicated is I would very much appreciate a PR for an integration (if you have the will and time to support the project)

for an example implementation you can refer topython-pkcs1

[git-n-pissed]

Just did a test on an ESP32-S3 (running at 240MHz) to compare performance of the pure Python adafruit_rsa package against the ucrypto package which uses C for the heavy lifting. I made some slight modifications to the adafruit_rsa package to get it to run in MicroPython, most notably, replacing calls to adafruit specific packages with their Micropython analog (i.e. adafruit_binascii replaced with binascii, adafruit_hashlib replaced with hashlib, etc.). I also removed hash methods that adafruit_hashlib supported, but hashlib doesn't (i.e. all of them except SHA-1 and SHA-256).

The adafruit_rsa test (derived from ufastrsa_1.py):

from time import ticks_diff, ticks_ms

import adafruit_rsa

def main():

    bits = 1024
    print("RSA bits", bits)
    start = ticks_ms()
    # r = RSA(*genrsa(bits, e=65537))
    r = adafruit_rsa.newkeys(bits)
    if r:
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("RSA OK")
        data = b"a message to sign and encrypt via RSA"
        print("random data len:", len(data), data)
        start = ticks_ms()
        # assert r.pkcs_verify(r.pkcs_sign(data)) == data
        assert adafruit_rsa.verify(data, adafruit_rsa.sign(data, r[1], "SHA-256"), r[0]) == "SHA-256"
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("pkcs_verify OK")
        start = ticks_ms()
        # assert r.pkcs_decrypt(r.pkcs_encrypt(data)) == data
        assert adafruit_rsa.decrypt(adafruit_rsa.encrypt(data, r[0]), r[1]) == data
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("pkcs_decrypt OK")


if __name__ == "__main__":
    main()

The ucrypto test (ufastrsa_1.py):

from time import ticks_diff, ticks_ms

from ufastrsa.rsa import RSA, genrsa


def main():

    bits = 1024
    print("RSA bits", bits)
    start = ticks_ms()
    r = RSA(*genrsa(bits, e=65537))
    if r:
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("RSA OK")
        data = b"a message to sign and encrypt via RSA"
        print("random data len:", len(data), data)
        start = ticks_ms()
        assert r.pkcs_verify(r.pkcs_sign(data)) == data
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("pkcs_verify OK")
        start = ticks_ms()
        assert r.pkcs_decrypt(r.pkcs_encrypt(data)) == data
        end = ticks_ms()
        print(ticks_diff(end, start))
        print("pkcs_decrypt OK")


if __name__ == "__main__":
    main()

The results:

MicroPython v1.19.1-706-g1c4b5d18f-dirty on 2022-12-14; ESP32S3 module with ESP32S3
Type "help()" for more information.
>>> import adafruit_rsa_1
>>> import ufastrsa_1
>>> adafruit_rsa_1.main()
RSA bits 1024
638537
RSA OK
random data len: 37 b'a message to sign and encrypt via RSA'
5601
pkcs_verify OK
5586
pkcs_decrypt OK
>>> ufastrsa_1.main()
RSA bits 1024
43386
RSA OK
random data len: 37 b'a message to sign and encrypt via RSA'
2062
pkcs_verify OK
2064
pkcs_decrypt OK

So ucrypto is the clear winner, especially in key generation where ucrypto took 43 seconds, but adafruit_rsa took nearly 11 minutes!
One note though, the verification test may not be apples to apples. The adafruit_rsa package requires that the hash method be specified. I specified SHA-256 because it was the best supported by hashlib, but I'm not sure what ucrypto is using in the background.