[alvaroelpob]

What

Implements RSA_get0_key, DH_get0_pqg, DH_get0_key, DSA_get0_pqg and DSA_get0_key in libSceLibreSsl3, which threw and were declared without parameters.

The module is LibreSSL 4.0.0 (firmware 13.40 measurements in #8981). Signatures, layouts and results follow that release's rsa_local.h, rsa_lib.c, dh_local.h, dh_lib.c, dsa_local.h and dsa_lib.c. Each writes the requested fields through the non-null output pointers and leaves the others alone:

Export	Fields
void RSA_get0_key(const RSA*, const BIGNUM** n, const BIGNUM** e, const BIGNUM** d)	n (24), e (32), d (40)
void DH_get0_pqg(const DH*, const BIGNUM** p, const BIGNUM** q, const BIGNUM** g)	p (8), q (64), g (16)
void DH_get0_key(const DH*, const BIGNUM** pub_key, const BIGNUM** priv_key)	pub_key (32), priv_key (40)
void DSA_get0_pqg(const DSA*, const BIGNUM** p, const BIGNUM** q, const BIGNUM** g)	p (16), q (24), g (32)
void DSA_get0_key(const DSA*, const BIGNUM** pub_key, const BIGNUM** priv_key)	pub_key (40), priv_key (48)

The structs are 152, 128 and 112 bytes. The offsets were checked with static_asserts and against offsetof from the 4.0.0 headers compiled on x86-64; the 4.0.0 RSA has no engine field, unlike the 2.5.4 one in libSceLibreSsl. LibreSSL reads the key only for the outputs requested: with every output null the call returns without reading it, and a null key throws only when an output is requested, where LibreSSL would dereference it. This library doesn't list the module's own RSA_new, d2i_RSA_PUBKEY and the other key-creating exports yet, so on Linux a title's import of them binds to libSceLibreSsl, whose RSA and DSA use the 2.5.4 layout; the debt entry records it. On firmware 13.42 the module makes its own keys with these 4.0.0 offsets.

The debt entry records the source and what is unverified. The pending-export count drops from 84 to 79, and the five names join the exclusion list.

Tested

Ubuntu 26.04 (WSL2, kernel 6.18), GCC 15.2.0, Release, full build with BUILD_TESTING=ON on main 379b1dc. There is one commit per function, and each adds that function with its test block and debt update. Each was built and its guest_libressl3_key_components test and check_conventions.py run on its own.

• New guest_libressl3_key_components test, on LibreSsl3Rsa, LibreSsl3Dh and LibreSsl3Dsa objects whose every pointer field holds a distinct address. Each accessor returns exactly its slots, leaves outputs passed as null and untouched outputs alone, returns null for fields that are null, returns without reading a null key when every output is null, and throws for a null key when any output is requested.
• Full ctest -j16 at the last commit: 2005/2006 pass. agc_driver_multisample_retirement fails the same way on main on this machine.
• Not tested: Windows, a title.
• Rebased on main e7e3e9c, head 476c2c6. The branch still merged cleanly, but after refactor(libs): add full export headers for libs #10706 public_headers fails on the merge: the exports kept their (void) stubs in include/Api.hpp and the test redeclared them. 476c2c6 (refactor(libSceLibreSsl3): declare the key component exports in the public header) puts the real signatures and their structs in libSceLibreSsl3/include/Api.hpp and drops the test's redeclarations. Full build and ctest -j16: 2202/2203 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main 6e775f4, head dfb0b57, to resolve the conflicts with main on the shared CMakeLists.txt and debt-file lines; both sides are kept and the count is 84 minus this PR's exports. Review fixes cc8bfe4, 1a7514f and dfb0b57 make a call with every output null return without reading the key, build the tests on the public structs and update the debt entry; guest_libressl3_key_components passes. Full build and ctest -j16: 2268/2269 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• e2d9aaa rewrites the debt entry to state that gap and cite the 13.42 run; docs only. Full build and ctest -j16 on main 6e775f4: 2268/2269 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.
• Rebased on main 74acfad (after feat(libSceLibreSsl3): implement ASN.1 integer decoding #10948), head 4d500b4, to resolve the conflicts with main on the shared CMakeLists.txt and debt-file lines; both sides are kept and the count is 83 minus this PR's exports. Full build and ctest -j16: 2431/2432 pass; agc_driver_multisample_retirement fails the same way on that main. check_conventions.py --base upstream/main passes.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: feat(libSceLibreSsl): implement numeric ERR formatting and newest peeking #9535, feat(libSceLibreSsl): implement memory BIOs #9536, feat(libSceLibreSsl): implement CMAC with AES-CBC methods #9571, feat(libressl3): report OpenSSL version strings #9970, feat(libSceLibreSsl3): implement ASN1_STRING_get0_data and ASN1_INTEGER_free #10452, feat(libSceLibreSsl3): implement ASN1_OBJECT_free #10461
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (91db3f7 → 7c7b3f8)

📈 System libraries: 27.12% (+0.02%, +5 implemented, +4 declared functions)

✅ 5 implemented

Library	Name
libSceLibreSsl3	DH_get0_key_nid_postfix
libSceLibreSsl3	DH_get0_pqg_nid_postfix
libSceLibreSsl3	DSA_get0_key_nid_postfix
libSceLibreSsl3	DSA_get0_pqg_nid_postfix
libSceLibreSsl3	RSA_get0_key_nid_postfix

🆕 4 declared as stubs

Library	Name
libSceLibreSsl3	EVP_PKEY_get1_RSA_nid_disambig1_nid_postfix
libSceLibreSsl3	PEM_read_RSAPrivateKey_nid_disambig1_nid_postfix
libSceLibreSsl3	RSA_new_nid_disambig1_nid_postfix
libSceLibreSsl3	d2i_RSA_PUBKEY_nid_disambig1_nid_postfix

Changed libraries (implemented exports)

Library	Before	After	Change
libSceLibreSsl3	9/270 (3.33%)	14/274 (5.11%)	+1.78%

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[MarcZX10]

Reviewed head f05c46e39d10a6d3a5cfe5eb481313ea460b49c3.

I checked the five accessors against the pinned LibreSSL 4.0.0 structures and getter behavior. The asserted sizes/offsets for RSA, DH, and DSA match their field order, and each accessor writes only non-null output pointers from the specified fields. The null-key exception path and output-selection tests are consistent with the stated compatibility approach. I found no blocking correctness issue in this diff.

The PR reports focused accessor tests and a 2005/2006 full CTest run, with the remaining failure also present on main; I did not reproduce these runs locally. Current convention, labels, eligibility, and report checks pass; Linux, Windows, register-context, relinker, write-watch, and ASan jobs are skipped. The overlap report with #10557 lists shared build/export/debt files but no same exports; coordinate those file edits when composing the changes.

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 10395	core/libs/prx/libSceLibreSsl3/include/Api.hpp L16-20
PR 10915		RSA_new d2i_RSA_PUBKEY
PR 11128		EVP_PKEY_get1_RSA RSA_new d2i_RSA_PUBKEY
PR 11146		RSA_new d2i_RSA_PUBKEY
PR 11151		RSA_new d2i_RSA_PUBKEY
PR 11175		RSA_new d2i_RSA_PUBKEY
PR 11466		RSA_new d2i_RSA_PUBKEY
PR 12315	core/libs/prx/libSceLibreSsl3/CMakeLists.txt L1 docs/dev/debt/libSceLibreSsl3.md L5
PR 12754	docs/dev/debt/libSceLibreSsl3.md L5
PR 12928	core/libs/prx/libSceLibreSsl3/Export.cpp L44-66
PR 12945	docs/dev/debt/libSceLibreSsl3.md L5
PR 13897	core/libs/prx/libSceLibreSsl3/Export.cpp L149-163 core/libs/prx/libSceLibreSsl3/include/Api.hpp L38-40 docs/dev/debt/libSceLibreSsl3.md L5

Exports introduced here that are already present in main:

• EVP_PKEY_get1_RSA
PEM_read_RSAPrivateKey
RSA_new
d2i_RSA_PUBKEY
libreSsl3Forward_EVP_PKEY_get1_RSA_nid_no_patch
libreSsl3Forward_PEM_read_RSAPrivateKey_nid_no_patch
libreSsl3Forward_RSA_new_nid_no_patch
libreSsl3Forward_d2i_RSA_PUBKEY_nid_no_patch

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 10960	core/libs/prx/libSceLibreSsl3/CMakeLists.txt core/libs/prx/libSceLibreSsl3/Export.cpp core/libs/prx/libSceLibreSsl3/include/Api.hpp docs/dev/debt/libSceLibreSsl3.md
PR 11146	core/libs/prx/libSceLibreSsl3/CMakeLists.txt core/libs/prx/libSceLibreSsl3/include/Api.hpp docs/dev/debt/libSceLibreSsl3.md
PR 14212	docs/dev/debt/libSceLibreSsl3.md

[alvaroelpob]

Rebased on main e7e3e9c, head 476c2c6. The branch still merged cleanly, but after #10706 public_headers fails on the merge: the exports kept their (void) stubs in include/Api.hpp and the test redeclared them. 476c2c6 puts the real signatures and their structs in include/Api.hpp and drops the redeclarations. Full suite 2202/2203, with the same failure on main.

[oneandonlydean]

@alvaroelpob Thanks for moving the declarations; the header part is resolved. One behaviour question remains: the PR still rejects a null key unconditionally, and five tests require calls with all outputs null to throw. In pinned LibreSSL 4.0.0 these getters only dereference the key for the outputs that are requested, so a call with no outputs is a no-op. Please either follow that (no-output call returns without touching the key, with tests for it, and the body/debt updated), or cite a console-side source showing the different contract. The TestKey reinterpret fixtures should also use the canonical public objects rather than cast stand-ins.

[ycbuzi]

Windows run of 476c2c67c6 merged onto main 49d9c1c751 (d434716844, clean). Windows 11 Home 10.0.26200, WinLibs MinGW-w64 GCC 15.2.0 (ucrt-posix-seh r7), Release, BUILD_TESTING=ON.

• Built guest_libressl3_key_components_tests with no errors or warnings.
• ctest --repeat until-fail:2: guest_libressl3_key_components passes both runs.
• No negative control: the implementation is a new source file, so main's tree can't build this test without it.

Not run: a title. AI-assisted: yes (Claude Code)

[alvaroelpob]

@oneandonlydean Followed LibreSSL 4.0.0: the five getters now read the key only for the outputs requested, so a call with every output null returns without touching it, and a null key throws only when an output is requested (cc8bfe4). The tests use LibreSsl3Rsa, LibreSsl3Dh and LibreSsl3Dsa instead of the TestKey cast and check the no-output calls with a null key (1a7514f); the debt entry says the same (dfb0b57). Rebased on main 6e775f4 first. guest_libressl3_key_components passes; full ctest -j16 2268/2269, agc_driver_multisample_retirement fails the same way on main.

[ahmadmuj]

Checked head dfb0b57aa4d2 (base 6e775f452ae9; also merges clean onto main ae7d59258ea7). Linux, GCC 13.3, Release.

What I ran:

• guest_libressl3_key_components on the merge: pass. public_headers: pass. check_conventions.py: pass.
• Compiled the rsa_st/dh_st/dsa_st from the 4.0.0 *_local.h at ce488b78: 152/128/112 bytes, and every offset you read matches. The get0 bodies match rsa_lib.c, dh_lib.c and dsa_lib.c, and the new null-key handling is right.
• Mutated the offsets and the null-key paths (9 mutations): all go red.
• Merged #10915 (head 5576345be456, the 2.5.4 RSA in libSceLibreSsl) on top and ran a probe through both libraries.

So on its own this is right for 4.0.0. The problem is where an l3 title gets its RSA from, same pattern I raised on #10960:

• In the 3.20 table, libSceLibreSsl3 also exports RSA_new, d2i_RSA_PUBKEY, EVP_PKEY_get1_RSA, PEM_read_RSAPrivateKey etc. under the same NIDs as libSceLibreSsl. It has no RSA_set0_key, and rsa_st is private in 4.0.0, so a title can't build its own RSA. Every key that reaches RSA_get0_key comes from one of those shared calls.
• Our libSceLibreSsl3 doesn't implement them, so on Linux they bind to libSceLibreSsl. LD_DEBUG=bindings on an exe that only needs libSceLibreSsl3.prx: PFxpQ6lkQP0 (d2i_RSA_PUBKEY) and kADEz2eAE7c (RSA_new) bind to libSceLibreSsl.prx, 9RMSBpPZVdk (RSA_get0_key) binds to libSceLibreSsl3.prx.
• l1 uses the public 2.5.4 layout, which still has ENGINE *engine at 24, so n is at 32.

Composed run, 2048-bit key: l1 d2i_RSA_PUBKEY -> l3 RSA_get0_key(rsa, &n, &e, &d) gives n = NULL, e = the modulus (top=32, low word 0xd941211635074acf), d = 65537. Each field comes from one slot too early. Both PRs' own tests pass, so it only shows once both land.

DSA has the same shift, read from the headers, not run: 2.5.4 dsa_st has int write_params after version, so p is at 24, not 16. l3 DSA_get0_pqg would hand back write_params (1 after DSA_new) as p. Nothing creates an l1 DSA yet, so that one is latent. DH is fine: the offsets are the same in 2.5.4 and 4.0.0.

What I'd suggest: read RSA and DSA through the 2.5.4 layout (#10915's LibreSslRsa for RSA). Titles can't see the 4.0.0 offsets anyway, and that's the object they actually get. The other way is to implement the l3 NIDs for every call that creates or frees these keys, which is a lot more surface. The debt line "No export of this module creates a key yet, so only keys the caller builds reach them" should change either way: the keys come from libSceLibreSsl.

[BunnyFl]

@alvaroelpob @oneandonlydean @ahmadmuj firmware 13.42 data on both open points. These are runs of the decrypted libSceLibreSsl3.sprx on a PC, not a console. KeyComponents.cpp from dfb0b57aa4 is compiled unchanged with the PR's three structs.

No-output calls. The module handles them the way this head does. I ran its RSA_get0_key, DH_get0_pqg, DH_get0_key, DSA_get0_pqg and DSA_get0_key in Unicorn on all 64 combinations of requested and null outputs, with a marker-filled key or a null key.

• With a real key, only the requested outputs are written: RSA n/e/d from 0x18/0x20/0x28, DH p/q/g from 0x8/0x40/0x10 and pub/priv from 0x20/0x28, DSA p/q/g from 0x10/0x18/0x20 and pub/priv from 0x28/0x30.
• With a null key and every output null, all five return normally. With a null key and any output requested, the module faults before writing any output (the harness maps nothing at address 0). Per the disassembly, none of the five checks the key for null.
• The PR gives the same 64 results, with a throw where the module faults. Three identical runs on each side.
• Controls: copies of KeyComponents.cpp with one change each are caught. These are throwing on a null key regardless of outputs (the code before cc8bfe4, which differs on the five no-output calls), and reading e from d, DH q from g, DH pub from priv, and DSA priv from pub.

Where an l3 RSA comes from on 13.42. libSceLibreSsl3.sprx exports its own RSA_new, RSA_free, RSA_set0_key, d2i_RSA_PUBKEY, EVP_PKEY_get1_RSA and PEM_read_RSAPrivateKey. As in #10960, it doesn't depend on libSceLibreSsl.prx, and no binary in the dump links both. I ran the module's own code natively:

• RSA_new allocates a 152-byte object. RSA_set0_key stores n/e/d at 0x18/0x20/0x28, and the PR's RSA_get0_key returns the three pointers that were set.
• d2i_RSA_PUBKEY on a 2048-bit SubjectPublicKeyInfo, then the PR's RSA_get0_key: n has 2048 bits and all 256 bytes equal the key's modulus, e = 65537, d = NULL. The module's own RSA_get0_key returns the same pointers. Three identical runs.
• Control: the same run with the 2.5.4 layout (a pointer inserted before n, as with ENGINE *engine) returns 65537 as n and NULL as e.

So on 13.42 the module's own RSA objects use these 4.0.0 offsets. Reading through the 2.5.4 layout would shift those objects by one slot. The l1-created keys in your composed run reach l3 through the emulator binding the missing l3 NIDs to libSceLibreSsl; on 13.42, libSceLibreSsl3 has those NIDs itself.

[alvaroelpob]

@ahmadmuj @BunnyFl thanks, both. BunnyFl's 13.42 run shows that libSceLibreSsl3.sprx makes its own RSA objects through its own RSA_new, RSA_set0_key and d2i_RSA_PUBKEY, with n/e/d at 0x18/0x20/0x28. With the 2.5.4 layout, the control returns 65537 as n. So this PR keeps the 4.0.0 offsets, which match what the module's code reads.

The mismatch in the composed run is real on our side, though. This library doesn't list those key-creating exports yet, so on Linux they bind to libSceLibreSsl and hand over 2.5.4 objects. e2d9aaa replaces the debt entry's "only keys the caller builds" with that gap. The fix is to implement them in libSceLibreSsl3, which is beyond these five accessors.

[ycbuzi]

A Windows rerun of the new head e2d9aaa0a8, merged onto main 32b7331c44 with no conflicts: Windows 11 Home 10.0.26200, WinLibs GCC 15.2.0 r7 (MinGW-w64 UCRT), Release, plain ctest --repeat until-fail:2.

• guest_libressl3_key_components passes, 2 of 2. The build has no warnings. No negative control, since the functions live in the new KeyComponents.cpp.

AI-assisted: yes (Claude Code)

[alvaroelpob]

@oneandonlydean done in 2f913e3, 0814670 and ad00df5 (head ad00df5):

• 2f913e3 declares RSA_new, d2i_RSA_PUBKEY, EVP_PKEY_get1_RSA and PEM_read_RSAPrivateKey in libSceLibreSsl3 as throwing _nid_disambig1 stubs, under the NIDs of the 3.20 table (kADEz2eAE7c, PFxpQ6lkQP0, 5RBpaKVkWRQ, psMmvmdPKds, the same in libSceLibreSsl). The DH/DSA equivalents in that table, EVP_PKEY_get0_DH and EVP_PKEY_get0_DSA, and EVP_PKEY_get0_RSA and d2i_RSAPublicKey_bio were already libSceLibreSsl3 stubs; the table has no DH or DSA constructor.
• 0814670 adds libressl3_import_binding (Linux): it dlopens the patched libSceLibreSsl3.prx and checks that each of those NIDs, d2i_RSA_PUBKEY included, resolves to libSceLibreSsl3.prx and not to libSceLibreSsl.prx, which also exports them. With the fix commit reverted it fails with all four binding to libSceLibreSsl.prx. On Windows each import names its DLL, so there is no fallback to test.
• ad00df5 updates the debt entry and the pending count (76 to 80).

Full ctest -j16 2544/2545, with agc_driver_multisample_retirement failing on this base's main too; conventions pass; still merges cleanly with current main.

[msbutt1]

@alvaroelpob #13267 (RSA_up_ref) also defines LibreSsl3Rsa, in include/Key.hpp, so the two PRs produce a duplicate definition once both land. Its layout matches yours (152 bytes, n at 24, d at 40) and names the fields after iqmp, which RSA_up_ref needs for references at 104.

Since #13267 has no dependencies and this PR waits on #9535, #9536, #9571, #9970, #10452 and #10461, I propose #13267 lands first. I merged your head ad00df544b onto #13267 to check what that costs this PR:

• add #13267 to Depends on;
• remove LibreSsl3Rsa from Api.hpp, which already includes Key.hpp;
• rename rsa.meth to rsa.method in core/libs/tests/GuestLibreSsl3KeyComponents.cpp:14, matching the method field of LibreSsl3EvpPkey and LibreSsl3EcKey.

With those, every libSceLibreSsl3 source, both of your tests and GuestLibreSsl3KeyReference.cpp compile; KeyComponents.cpp is unchanged. The only other conflict is the pending count in the debt file. Does that order work for you?

[alvaroelpob]

Rebased on main da026c7 (head 1685871) to resolve the conflicts on the shared debt-file lines; no change to this PR's functions. Pending count 80 matches the stubs in Export.cpp. Full ctest -j16 3008/3008 (main 3006/3006), conventions pass.

@msbutt1 thanks for checking the merge. This PR was opened first, so I'm keeping the order: Depends on stays as is, and #13267 rebases after it. Both layouts are the same 152 bytes, so #13267 can name the fields after iqmp (references at 104) in this LibreSsl3Rsa instead of adding a second definition.

[msbutt1]

@alvaroelpob sounds good, #10490 goes first. #13267 now declares Depends on: #10490. After this merges, #13267 drops its own definition and replaces unsigned char rest[64] here with the named fields after iqmp; n, e, d and the size stay as they are. I prepared that version on your head 16858710b4, and guest_libressl3_key_components passes on it.

[alvaroelpob]

#13267 merged first, so this is rebased on main 50843f4 (head 7c7b3f8). New commit 7c7b3f8 drops this PR's LibreSsl3Rsa and uses main's from Key.hpp (same 152 bytes, n at 24, d at 40), and renames rsa.meth to rsa.method in the test. Pending count 79 matches the stubs, with RSA_up_ref kept in the exclusion list. Full ctest -j16 3016/3016 (main 3014/3014 on the same machine), conventions pass. Depends on is unchanged.