disclude.iocrates.io / rsa / 0.10.0-rc.20
rsa 0.10.0-rc.20
- Source
- https://github.com/RustCrypto/RSA
- Artifact scanned
rsa-0.10.0-rc.20.crate- Compared with
rsa-0.10.0-rc.19.crate(8 signals introduced since)- Files
- 54 scanned, 33 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 41 info
- Scan time
- 14.9 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 20 of 20 warn and critical signals; 20 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-11-03 05:46
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
/// <div class="warning"> /// <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> /// /// Use this function with great care! Raw RSA should never be used without an appropriate padding -
//! <div class="warning"> //! <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> //! //! This module holds functions that apply RSA's core encryption and decryption -
//! <div class="warning"> //! <b> ☢⟨U+FE0F⟩⟨U+FE0F⟩ WARNING: HAZARDOUS API ☢⟨U+FE0F⟩</b> //! //! This module holds functions that apply RSA's core encryption and decryption -
const DECRYPT_VAL: &str = "\ XW4qfrpQDarEMBfPyIYE9UvuOFkbBi0tiGYbIOJPLMNe/LWuPD0BQ7ceqlOlPPcK\ LinYz0DlnqW3It/V7ae59zw9afA3YIWdq0Ut2BnYL+aJixnqaP+PjsQNcHg6axCF\ 11iNQ4jpXrZDiQcI+q9EEzZDTMsiMxtjfgBQUd8LHT87YoQXDWaFPCVpliACMc8a\likely benign A multi-line base64 constant (DECRYPT_VAL) in a Rust benchmark, likely encoded test ciphertext or key material.Reasoning
Raw-pass base64-like lines form a constant string literal in a benchmark file, consistent with encrypted or encoded key test data used to exercise decryption. The surrounding crypto-library context makes this a legitimate test fixture, not a payload.
-
// And the product is: // P = 2^todo × α // where α is the product of nprimes numbers of the form 0.11... // -
// P = 2^todo × α // where α is the product of nprimes numbers of the form 0.11... // // If α < 1/2 (which can happen for nprimes > 2), we need to -
// // If α < 1/2 (which can happen for nprimes > 2), we need to // shift todo to compensate for lost bits: the mean value of 0.11... // is 7/8, so todo + shift - nprimes * log2(7/8) ~= bits - 1/2 -
//! let pem = "-----BEGIN RSA PUBLIC KEY----- //! MIIBCgKCAQEAtsQsUV8QpqrygsY+2+JCQ6Fw8/omM71IM2N/R8pPbzbgOl0p78MZ //! GsgPOQ2HSznjD0FPzsH8oO2B5Uftws04LHb2HJAYlz25+lN5cqfHAfa3fgmC38Ff //! wBkn7l582UtPWZ/wcBOnyCgb3yLcvJrXyrt8QxHJgvWO23ITrUVYszImbXQ67YGS -
//! MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtsQsUV8QpqrygsY+2+JC //! Q6Fw8/omM71IM2N/R8pPbzbgOl0p78MZGsgPOQ2HSznjD0FPzsH8oO2B5Uftws04 //! LHb2HJAYlz25+lN5cqfHAfa3fgmC38FfwBkn7l582UtPWZ/wcBOnyCgb3yLcvJrX //! yrt8QxHJgvWO23ITrUVYszImbXQ67YGS0YhMrbixRzmo2tpm3JcIBtnHrEUMsT0N -
/// let n_bytes = Base64::decode_vec("seAOhmYFAjH6NOaB54dboqw86uPXV/oK9ayJGV4mVClbvsDBJmF3bVkOaVMp9ogcFJTFFSy5g2HsTZIfHyuQVUJADb+BeRnkYrYhRvNJOKj2pcDbkxYe9XGMx8pIvxkDFnIpusb3gUsuzMUAU5qIstjwQKzuD51c6uJi0HAtQkr6Wmlt34SX7xkD/MfRuTu9uqmHmkiiJaCDHB2reYTPguetSWfuvp1qBJDNgSsp7BjwYANWldyrmZ8cLXEXYMUG5vtsWMxUzl8ertEr6kbnGM -
/// let n_bytes = Base64::decode_vec("seAOhmYFAjH6NOaB54dboqw86uPXV/oK9ayJGV4mVClbvsDBJmF3bVkOaVMp9ogcFJTFFSy5g2HsTZIfHyuQVUJADb+BeRnkYrYhRvNJOKj2pcDbkxYe9XGMx8pIvxkDFnIpusb3gUsuzMUAU5qIstjwQKzuD51c6uJi0HAtQkr6Wmlt34SX7xkD/MfRuTu9uqmHmkiiJaCDHB2reYTPguetSWfuvp1qBJDNgSsp7BjwYANWldyrmZ8cLXEXYMUG5vtsWMxUzl8ertEr6kbnGM -
// -----BEGIN RSA PRIVATE KEY----- // MIIEpAIBAAKCAQEA05e4TZikwmE47RtpWoEG6tkdVTvwYEG2LT/cUKBB4iK49FKW // icG4LF5xVU9d1p+i9LYVjPDb61eBGg/DJ+HyjnT+dNO8Fmweq9wbi1e5NMqL5bAL // TymXW8yZrK9BW1m7KKZ4K7QaLDwpdrPBjbre9i8AxrsiZkAJUJbAzGDSL+fvmH11 -
// -----BEGIN RSA PRIVATE KEY----- // MIIBOgIBAAJBALKZD0nEffqM1ACuak0bijtqE2QrI/KLADv7l3kK3ppMyCuLKoF0 // fd7Ai2KW5ToIwzFofvJcS/STa6HA5gQenRUCAwEAAQJBAIq9amn00aS0h/CrjXqu // /ThglAXJmZhOMPVn4eiu7/ROixi9sex436MaVeMqSNf7Ex9a8fRNfWss7Sqd9eWu -
likely benign A base64 expected-signature test vector in a parameterized #[case] test.
Reasoning
The base64 string is an expected signature paired with a message in a #[case] test table. This is standard known-answer test vector data for PKCS#1 v1.5 signing and carries no execution or obfuscation.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Same pattern as the other #[case] entries: a base64 signature test vector with its message, in a crypto test table.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Base64 known-answer signature vector in a test case table alongside a message string. Expected for an RSA signature library.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Base64 signature test vector paired with a long message input in a test case table. Standard test data.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Duplicate of the first #[case] vector in a second test function. Standard test data.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Duplicate of an existing test vector in another test function, consistent with signature known-answer testing.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Duplicate test vector in a parameterized test table. No executable or hidden behavior.
-
likely benign A base64 signature test vector in a parameterized #[case] test.
Reasoning
Duplicate test vector in a parameterized test table, consistent with signature known-answer testing.
-
let msg = b"Thu Dec 19 18:06:16 EST 2013\n"; let expected_sig = decode_vec.unwrap; let priv_key = get_private_key;likely benign A base64 expected-signature constant decoded in a unit test.Reasoning
Base64::decode_vec decodes a fixed expected signature inside a unit test, next to a fixed message and a test private key. This is ordinary test code.
-
let msg = b"Thu Dec 19 18:06:16 EST 2013\n"; let expected_sig = decode_vec.unwrap; let priv_key = get_private_key;likely benign A base64 expected-signature constant decoded in a unit test.Reasoning
Same as the preceding finding: a fixed base64 expected signature decoded in a test function, with no runtime or network behavior.
-
// Check that Πprimes == n. let mut m = one_with_precision; let one = one; -
// inverse. Therefore e is coprime to lcm(p-1,q-1,r-1,...) = // exponent(ℤ/nℤ). It also implies that a^de ≡ a mod p as a^(p-1) ≡ 1 // mod p. Thus a^de ≡ a mod n for all a coprime to n, as required. let de = key.d.concatenating_mul; -
let n = decode_veclikely benign A multi-line base64 constant decoded into key material, likely a test private key.Reasoning
A base64 string split across backslash-continued lines is passed to Base64::decode_vec. This is the common pattern for embedding RSA key material in tests or fixtures. Decoding a constant key is not malicious.
-
let d = decode_veclikely benign A multi-line base64 constant decoded into key material, likely a test private key component.Reasoning
Another multi-line base64 constant passed to Base64::decode_vec, consistent with embedded RSA private key components (such as d) in test code.
-
decode_veclikely benign Base64-encoded RSA key test-vector literal decoded with Base64::decode_vec.Reasoning
Raw-pass base64 signal on a multi-line string literal passed to Base64::decode_vec. The blob is high-entropy but compresses poorly, as expected for key material. The surrounding code is a Rust RSA crate, where such literals are test vectors encoded as base64 and decoded at runtime. That is a legitimate pattern, and the raw pass has a high false-positive rate. Nothing decodes it into something executed.
-
decode_veclikely benign Another base64-encoded key-material literal decoded in a test-style context.Reasoning
Same pattern as the neighbouring finding: a base64 string literal of key material passed to Base64::decode_vec, in a cryptography library's test data. The raw pass flags entropy alone here, and the decoded content is only used as key data, not executed.
-
decode_veclikely benign Base64 key-material literal decoded via Base64::decode_vec.Reasoning
Base64 literal of key bytes passed to a decoder inside an RSA library. The entropy-based raw signal fits legitimate encoded test or fixture key material. There is no execution, network access or process spawn.
-
decode_veclikely benign Base64 key-material literal in a Rust RSA crate, decoded at runtime.Reasoning
Repeats the same structure: consecutive base64 lines of key bytes in a string literal decoded by Base64::decode_vec. This is consistent with embedded test vectors in a cryptographic crate and shows no sign of malicious intent.
-
decode_veclikely benign Base64-encoded key fixture decoded in an RSA library's source.Reasoning
Base64 literal of key material decoded with Base64::decode_vec in a cryptography library. The raw encoding signal is expected for embedded key fixtures, and the decoded bytes are only used as key data.
-
// -----BEGIN PUBLIC KEY----- // MIIEKjANBgkqhkiG9w0BAQEFAAOCBBcAMIIEEgKCBAkAqQn6O7pd9ioQJEOwS2sh // nD2bM3+PaLovro+OKOE9t7jxrp+b9Xq81oeT6zN5u5yPewa+V08ZsAJQEbF9D5AM // UZkHZc/sW/XAItC8CojQhHoCQfjOXZpONmGsQxnSJNgwLV5TDVKUApbQIPzIm9yD -
// -----BEGIN RSA PRIVATE KEY----- // MIIBOgIBAAJBALKZD0nEffqM1ACuak0bijtqE2QrI/KLADv7l3kK3ppMyCuLKoF0 // fd7Ai2KW5ToIwzFofvJcS/STa6HA5gQenRUCAwEAAQJBAIq9amn00aS0h/CrjXqu // /ThglAXJmZhOMPVn4eiu7/ROixi9sex436MaVeMqSNf7Ex9a8fRNfWss7Sqd9eWu -
-----BEGIN RSA PRIVATE KEY----- MIIBOgIBAAJBALKZD0nEffqM1ACuak0bijtqE2QrI/KLADv7l3kK3ppMyCuLKoF0 fd7Ai2KW5ToIwzFofvJcS/STa6HA5gQenRUCAwEAAQJBAIq9amn00aS0h/CrjXqu /ThglAXJmZhOMPVn4eiu7/ROixi9sex436MaVeMqSNf7Ex9a8fRNfWss7Sqd9eWulikely benign Embedded PEM RSA private key used as a test or example fixture in a Rust crypto crate.Reasoning
A PEM-armoured RSA private key embedded in a Rust source file. It sits in a crypto library, where such keys serve as test or example fixtures. The base64 body is just the encoded key, not a payload, and nothing decodes or executes it in a suspicious way.
-
const PRIV_KEY_PKCS1_PEM: &str = "-----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAwQe5brkkpxrwR/5TJ6JXsUyBzYtbEL/w8u8P6NnxQ8sL4KYp MzzTB6aq1gq7bieYXChg0PIWeTukGaOzZe96KxhT0GbhhYRlukktM/quRrM7nYdm UmXo7+KWU55kfcNOjWKADL/7qmxn6y/+kPmBg83nHdr1Mq6/pNkeHY/1CeGGECl0likely benign PKCS#1 PEM RSA private key constant in a test file.Reasoning
A PKCS#1 PEM RSA private key defined as a const &str in a test file for PKCS#1 v1.5 padding. This is a standard test fixture. The raw base64 signal is expected for key data, and there is no execution or network behaviour.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&