RSA key comparison: exit early after MODULUS / PUBLIC_EXPONENT are compared - no round-trip to HSM

[space88man]

Addresses #345.

RSA keys: the match operator was falling-through to the generic comparator (look for associated objects) instead of exiting early after EXPONENT/MODULUS were verified

RSA keys should never need to use find_associated_obj: the private key has enough attributes to do a logical comparison with the public key.

This is the same behaviour as OpenSC/libp11

[simo5]

It is probably better to just add a check for the modulus early on for CKK_RSA just where we check the public exponent, and then we can immediately return w/o even calling cmp_public_keys.

Alternatively, move the check for CKA_PUBLIC_EXPONENT into cmp_public_key_values(), and the initial check for CKK_RSA would simply call cmp_public_key_values() unconditionally (with a comment that Private RSA key always include the public attributes.

And again just return later on.
I think I prefer the latter option, because currently cmp_public_key_values() is misleading as not checking public exponent in there is kind of bad.

[space88man]

And again just return later on. I think I prefer the latter option, because currently cmp_public_key_values() is misleading as not checking public exponent in there is kind of bad.

Ok - colocated both checks (MODULUS/PUBLIC_EXPONENT)

[simo5]

Only a couple of style issues, then once CI is happy (ignore MacOS+softhsm if it fails, it if flaky) I'll merge.

[space88man]

Only a couple of style issues, then once CI is happy (ignore MacOS+softhsm if it fails, it if flaky) I'll merge.

Done - please check

[simo5]

LGTM