Endianness

[Henk7]

Hi please add the information about the byte-order of the properties. In the document https://msdn.microsoft.com/en-us/library/ms867080.aspx it is mentioned, that it is big-endian, but this is not easy to find.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: cec592a3-82b8-f4d5-ddfa-9e113209f113
• Version Independent ID: 8cb9de04-a0fb-f27a-a848-68bbd52f0396
• Content: RSAParameters Struct (System.Security.Cryptography)
• Content Source: xml/System.Security.Cryptography/RSAParameters.xml
• Service: .net
• GitHub Login: @mairaw
• Microsoft Alias: mairaw

[mairaw]

Thanks @Henk7. @bartonjs can you confirm we should add this to the RSAParameters class? Any other APIs that are worth calling this out as well? Thanks!

[bartonjs]

It seems pretty reasonable to add. The full rules of the arrays for RSAParameters values are as follows:

• Modulus: The unsigned big-endian representation of the RSA modulus value. Modulus[0] must not have the value 0x00.
• Exponent: The unsigned big-endian representation of the RSA public exponent value. Exponent[0] must not have the value 0x00.

The other fields must either all be null (public key parameters), or all non-null (private key parameters). When the values are non-null:

• D: The unsigned big-endian representation of the RSA private exponent value. This array must be equal in length to the length of the Modulus value, inserting 0x00-value bytes at low indexes as necessary.
• P: The unsigned big-endian representation of the RSA prime p. This array must be equal in length to half of the length of the Modulus value (round up if necessary), inserting 0x00-value bytes at low
  indexes as necessary.
• Q: The unsigned big-endian representation of the RSA prime q. This array must be equal in length to half of the length of the Modulus value (round up if necessary), inserting 0x00-value bytes at low indexes as necessary.
• DP: The unsigned big-endian representation of the RSA CRT parameter dp. This array must be equal in length to half of the length of the Modulus value (round up if necessary), inserting 0x00-value bytes at low indexes as necessary.
• DQ: The unsigned big-endian representation of the RSA CRT parameter dq. This array must be equal in length to half of the length of the Modulus value (round up if necessary), inserting 0x00-value bytes at low indexes as necessary.
• InverseQ: The unsigned big-endian representation of the RSA CRT parameter qInverse. This array must be equal in length to half of the length of the Modulus value (round up if necessary), inserting 0x00-value bytes at low indexes as necessary.

Example: For a RSA key with a KeySize value of 2056 and having the standard public exponent value 0x010001, the array lengths are:

Public Key:

• Modulus: 257 bytes
• Exponent: 3 bytes
• D, P, Q, DP, DQ, InverseQ: null values.

Private Key:

• Modulus: 257 bytes
• Exponent: 3 bytes
• D: 257 bytes
• P: 129 bytes
• Q: 129 bytes
• DP: 129 bytes
• DQ: 129 bytes
• InverseQ: 129 bytes

[james-k-polk]

I'm afraid these rules are somewhat inadequate because they fail to account for a large class of legitimate RSA parameters that might be generated by other software. In particular, the restriction of P and Q to lengths of exactly half the modulus length is too restrictive. Consider the following 1024-bit example: the prime P is about 512.1 bits, and the prime Q is about 511.1 bits. Their product is about 1023.2 bits, well within range of 1024-bit modulus. But P cannot be represented with less than 65 bytes, whereas these rules require P to use no more than 64 bytes.

See, for example, the parameters in this question.