SP now has support for RSA/DH 4096-bit operations

certs/4096/client-cert.pem

@@ -0,0 +1,130 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            2f:0f:ab:23:bc:a3:14:07:91:06:55:35:01:63:7f:42:bd:fb:f2:43
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, ST = Montana, L = Bozeman, O = wolfSSL_4096, OU = Programming-4096, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
+        Validity
+            Not Before: Jul  9 03:06:02 2019 GMT
+            Not After : Apr  4 03:06:02 2022 GMT
+        Subject: C = US, ST = Montana, L = Bozeman, O = wolfSSL_4096, OU = Programming-4096, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:f5:d0:31:e4:71:59:58:b3:07:50:dd:16:79:fc:
+                    c6:95:50:fc:46:0e:57:12:86:71:8d:e3:9b:4a:33:
+                    ea:4f:d9:17:13:6d:48:69:df:59:11:08:02:9d:af:
+                    2b:c7:30:be:0c:dc:87:d4:5a:12:09:23:5d:e1:76:
+                    5a:62:37:46:74:ef:03:05:bb:1e:6d:29:75:6c:2e:
+                    9d:87:0d:8f:87:cb:14:95:9b:be:17:6b:51:d1:4c:
+                    da:d7:91:66:c5:36:eb:e0:07:1a:76:4d:b0:fb:c1:
+                    f5:5e:05:db:ba:cb:25:d9:99:13:1c:c0:35:dc:40:
+                    e9:36:cd:c4:d5:7a:41:70:0f:36:eb:a5:4e:17:05:
+                    d5:75:1b:64:62:7a:3f:0d:28:48:6a:e3:ac:9c:a8:
+                    8f:e9:ed:f7:cd:24:a0:b1:a0:03:ac:e3:03:f5:3f:
+                    d1:96:ff:2a:7e:08:b1:d3:e0:18:14:ec:65:37:50:
+                    43:c2:6a:8c:f4:5b:fe:c4:cb:8d:3f:81:02:f7:c2:
+                    dd:e4:c1:8e:80:0c:04:25:2d:80:5a:2e:0f:22:35:
+                    4a:f4:85:ed:51:d8:ab:6d:8f:a2:3b:24:00:6e:81:
+                    e2:1e:76:d6:ac:31:12:db:f3:8e:07:a1:de:89:4a:
+                    39:60:77:c5:aa:f1:51:e6:06:f1:95:56:2a:e1:8e:
+                    92:30:9f:fe:58:44:ac:46:f2:fd:9a:fc:a8:1d:a1:
+                    d3:55:37:4a:8b:fc:9c:33:f8:a7:61:48:41:7c:9c:
+                    77:3f:f5:80:23:7d:43:b4:d5:88:0a:c9:75:d7:44:
+                    19:4d:77:6c:0b:0a:49:aa:1c:2f:d6:5a:44:a6:47:
+                    4d:e5:36:96:40:99:2c:56:26:b1:f2:92:31:59:d7:
+                    2c:d4:b4:21:d6:65:13:0b:3e:fb:ff:04:eb:b9:85:
+                    b9:d8:d8:28:4f:5c:17:96:a3:51:be:fe:7d:0b:1b:
+                    48:40:25:76:94:dc:41:fb:bf:73:76:da:eb:b3:62:
+                    e7:c1:c8:54:6a:93:e1:8d:31:e8:3e:3e:df:bc:87:
+                    02:30:22:57:c4:e0:18:7a:d3:ae:e4:02:9b:aa:bd:
+                    4e:49:47:72:e9:8d:13:2d:54:9b:00:a7:91:61:71:
+                    c9:cc:48:4f:ee:df:5e:1b:1a:df:67:d3:20:e6:44:
+                    45:98:7e:e7:0e:63:16:83:c9:26:5d:90:c1:e5:2a:
+                    5c:45:54:13:b2:81:18:06:20:2e:2e:66:5a:b5:7b:
+                    6e:d6:0c:4e:89:01:56:70:bb:ae:de:e9:99:5e:d1:
+                    b9:3a:b7:6c:17:b6:03:a9:08:dd:9c:f4:14:c9:c9:
+                    59:39:72:d4:7e:02:37:31:cd:0e:a7:3d:f8:f2:cf:
+                    6b:15:ab
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                FA:54:89:67:E5:5F:B7:31:40:EA:FD:E7:F6:A3:C6:5A:56:16:A5:6E
+            X509v3 Authority Key Identifier: 
+                keyid:FA:54:89:67:E5:5F:B7:31:40:EA:FD:E7:F6:A3:C6:5A:56:16:A5:6E
+                DirName:/C=US/ST=Montana/L=Bozeman/O=wolfSSL_4096/OU=Programming-4096/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
+                serial:2F:0F:AB:23:BC:A3:14:07:91:06:55:35:01:63:7F:42:BD:FB:F2:43
+
+            X509v3 Basic Constraints: 
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         57:0d:97:98:78:bf:2a:31:9a:39:41:38:33:46:d5:50:47:e8:
+         19:62:a8:36:1e:b7:fd:d1:bc:50:5c:3a:eb:96:1a:9b:43:b0:
+         67:5d:f4:51:77:87:33:0b:90:6f:e8:d3:82:4d:1a:aa:93:5f:
+         7d:78:b1:e0:7b:ee:88:01:e7:b3:fa:7e:0b:76:9c:9e:81:36:
+         e4:a3:c1:41:62:a4:0a:7e:24:d0:ab:9f:ba:d8:1e:38:ad:f1:
+         12:52:0d:f2:96:8a:0b:25:a2:49:3f:88:5b:ea:23:87:26:22:
+         7a:b9:60:6b:d6:7a:88:37:ac:64:9b:18:51:07:ea:df:00:96:
+         70:95:88:9d:8f:af:be:3c:4e:c7:5e:55:15:3d:1f:e4:2d:dc:
+         c9:a3:ae:af:fa:44:a8:e2:f4:df:8e:cd:f9:10:7f:8b:86:cc:
+         6d:45:91:91:4f:e3:d0:a7:d2:d9:8e:09:c6:f8:eb:e7:bd:17:
+         19:d6:e7:1a:b8:ca:4d:ec:34:07:7d:2d:e8:23:9d:82:e9:f7:
+         47:03:ab:5f:7c:f5:41:6f:70:11:cb:24:d8:23:c2:65:31:b7:
+         0b:8f:0a:26:5b:0f:f6:9b:11:7f:9a:8d:94:6d:5a:9c:5e:73:
+         35:15:7b:e3:09:e8:08:d0:3f:b4:e5:29:2c:f6:3e:71:6e:f4:
+         1b:20:55:34:40:2f:b0:9b:dd:f1:dc:bf:17:1d:a7:2d:85:01:
+         d6:d2:b2:56:56:98:33:85:ed:f6:a3:f6:3e:7b:f4:03:a4:58:
+         8e:c5:5b:ab:66:e8:0f:34:17:2d:33:36:71:0c:b8:d9:78:e7:
+         06:fc:da:4f:a1:fa:db:74:ce:ea:85:27:f9:75:a9:ad:50:86:
+         6e:ea:01:01:19:0d:28:4a:ed:06:be:65:70:b2:06:46:2e:16:
+         57:df:55:c7:8e:cd:5b:ad:66:28:b8:74:87:bf:c4:c7:08:3f:
+         37:a3:23:84:9f:4e:e8:48:6c:8d:54:9f:fb:e0:fb:53:a3:41:
+         e1:68:8a:94:c9:f5:ee:3e:15:46:d2:62:33:86:86:06:34:b4:
+         e4:2f:da:28:2e:2f:c0:bd:75:e8:2c:3f:e2:a5:43:7d:02:eb:
+         25:b9:ef:87:8a:d7:57:61:16:e8:9e:83:65:f9:10:f4:5e:5f:
+         1c:7a:25:d6:47:bd:29:c5:4f:8b:b9:6a:48:7a:9b:1e:6d:77:
+         8e:72:6c:0c:07:fe:4c:c5:cf:55:0e:cb:4b:ad:16:e1:e2:54:
+         b8:9d:34:03:d1:8d:b7:37:9b:e3:5a:32:60:03:7f:61:0f:50:
+         0b:72:54:8b:0d:c7:97:7e:bb:9b:b2:f7:73:47:71:7b:78:65:
+         36:df:57:72:9e:42:9c:8a
+-----BEGIN CERTIFICATE-----
+MIIG4DCCBMigAwIBAgIULw+rI7yjFAeRBlU1AWN/Qr378kMwDQYJKoZIhvcNAQEL
+BQAwgZ4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdC
+b3plbWFuMRUwEwYDVQQKDAx3b2xmU1NMXzQwOTYxGTAXBgNVBAsMEFByb2dyYW1t
+aW5nLTQwOTYxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJ
+ARYQaW5mb0B3b2xmc3NsLmNvbTAeFw0xOTA3MDkwMzA2MDJaFw0yMjA0MDQwMzA2
+MDJaMIGeMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwH
+Qm96ZW1hbjEVMBMGA1UECgwMd29sZlNTTF80MDk2MRkwFwYDVQQLDBBQcm9ncmFt
+bWluZy00MDk2MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG9w0B
+CQEWEGluZm9Ad29sZnNzbC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQD10DHkcVlYswdQ3RZ5/MaVUPxGDlcShnGN45tKM+pP2RcTbUhp31kRCAKd
+ryvHML4M3IfUWhIJI13hdlpiN0Z07wMFux5tKXVsLp2HDY+HyxSVm74Xa1HRTNrX
+kWbFNuvgBxp2TbD7wfVeBdu6yyXZmRMcwDXcQOk2zcTVekFwDzbrpU4XBdV1G2Ri
+ej8NKEhq46ycqI/p7ffNJKCxoAOs4wP1P9GW/yp+CLHT4BgU7GU3UEPCaoz0W/7E
+y40/gQL3wt3kwY6ADAQlLYBaLg8iNUr0he1R2Kttj6I7JABugeIedtasMRLb844H
+od6JSjlgd8Wq8VHmBvGVVirhjpIwn/5YRKxG8v2a/KgdodNVN0qL/Jwz+KdhSEF8
+nHc/9YAjfUO01YgKyXXXRBlNd2wLCkmqHC/WWkSmR03lNpZAmSxWJrHykjFZ1yzU
+tCHWZRMLPvv/BOu5hbnY2ChPXBeWo1G+/n0LG0hAJXaU3EH7v3N22uuzYufByFRq
+k+GNMeg+Pt+8hwIwIlfE4Bh6067kApuqvU5JR3LpjRMtVJsAp5FhccnMSE/u314b
+Gt9n0yDmREWYfucOYxaDySZdkMHlKlxFVBOygRgGIC4uZlq1e27WDE6JAVZwu67e
+6Zle0bk6t2wXtgOpCN2c9BTJyVk5ctR+AjcxzQ6nPfjyz2sVqwIDAQABo4IBEjCC
+AQ4wHQYDVR0OBBYEFPpUiWflX7cxQOr95/ajxlpWFqVuMIHeBgNVHSMEgdYwgdOA
+FPpUiWflX7cxQOr95/ajxlpWFqVuoYGkpIGhMIGeMQswCQYDVQQGEwJVUzEQMA4G
+A1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEVMBMGA1UECgwMd29sZlNT
+TF80MDk2MRkwFwYDVQQLDBBQcm9ncmFtbWluZy00MDk2MRgwFgYDVQQDDA93d3cu
+d29sZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb22CFC8P
+qyO8oxQHkQZVNQFjf0K9+/JDMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD
+ggIBAFcNl5h4vyoxmjlBODNG1VBH6BliqDYet/3RvFBcOuuWGptDsGdd9FF3hzML
+kG/o04JNGqqTX314seB77ogB57P6fgt2nJ6BNuSjwUFipAp+JNCrn7rYHjit8RJS
+DfKWigslokk/iFvqI4cmInq5YGvWeog3rGSbGFEH6t8AlnCViJ2Pr748TsdeVRU9
+H+Qt3Mmjrq/6RKji9N+OzfkQf4uGzG1FkZFP49Cn0tmOCcb46+e9FxnW5xq4yk3s
+NAd9LegjnYLp90cDq1989UFvcBHLJNgjwmUxtwuPCiZbD/abEX+ajZRtWpxeczUV
+e+MJ6AjQP7TlKSz2PnFu9BsgVTRAL7Cb3fHcvxcdpy2FAdbSslZWmDOF7faj9j57
+9AOkWI7FW6tm6A80Fy0zNnEMuNl45wb82k+h+tt0zuqFJ/l1qa1Qhm7qAQEZDShK
+7Qa+ZXCyBkYuFlffVceOzVutZii4dIe/xMcIPzejI4SfTuhIbI1Un/vg+1OjQeFo
+ipTJ9e4+FUbSYjOGhgY0tOQv2iguL8C9degsP+KlQ30C6yW574eK11dhFuieg2X5
+EPReXxx6JdZHvSnFT4u5akh6mx5td45ybAwH/kzFz1UOy0utFuHiVLidNAPRjbc3
+m+NaMmADf2EPUAtyVIsNx5d+u5uy93NHcXt4ZTbfV3KeQpyK
+-----END CERTIFICATE-----

certs/4096/client-key.pem

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEA9dAx5HFZWLMHUN0WefzGlVD8Rg5XEoZxjeObSjPqT9kXE21I
+ad9ZEQgCna8rxzC+DNyH1FoSCSNd4XZaYjdGdO8DBbsebSl1bC6dhw2Ph8sUlZu+
+F2tR0Uza15FmxTbr4Acadk2w+8H1XgXbussl2ZkTHMA13EDpNs3E1XpBcA8266VO
+FwXVdRtkYno/DShIauOsnKiP6e33zSSgsaADrOMD9T/Rlv8qfgix0+AYFOxlN1BD
+wmqM9Fv+xMuNP4EC98Ld5MGOgAwEJS2AWi4PIjVK9IXtUdirbY+iOyQAboHiHnbW
+rDES2/OOB6HeiUo5YHfFqvFR5gbxlVYq4Y6SMJ/+WESsRvL9mvyoHaHTVTdKi/yc
+M/inYUhBfJx3P/WAI31DtNWICsl110QZTXdsCwpJqhwv1lpEpkdN5TaWQJksViax
+8pIxWdcs1LQh1mUTCz77/wTruYW52NgoT1wXlqNRvv59CxtIQCV2lNxB+79zdtrr
+s2LnwchUapPhjTHoPj7fvIcCMCJXxOAYetOu5AKbqr1OSUdy6Y0TLVSbAKeRYXHJ
+zEhP7t9eGxrfZ9Mg5kRFmH7nDmMWg8kmXZDB5SpcRVQTsoEYBiAuLmZatXtu1gxO
+iQFWcLuu3umZXtG5OrdsF7YDqQjdnPQUyclZOXLUfgI3Mc0Opz348s9rFasCAwEA
+AQKCAgEAxXZXffFoGo7GY7kWoyvhwnTqEsTWQXVqptaeGn+VzErR9LMnJpVakQnk
+QBNFkZ+gK+jD3Fv2fQzCD6npdVh96tVNkj78dCiHwT25IZJNKIKEqKIRk/KMKRwZ
++G0/J1G1LaPHKB3E/JiUqND/8A/c+e2zorbtDV+/eFzXr72j74bpUWbbUjdHf+lf
+PJSDLeicM/Fs6fOml/6nv02bINUv3qQGu+5mSWv1EIWfhFpSPgygSkzaAcViMbHs
++N2jO85BOhJ5+ZdbB5WfhtYEc2zoj0xMSB2FxOfO3hYx9lw3VI5VvK8uR+isA7Ck
++ZCYmaTcbpgIXAe7CJOvYY10qPjEiWQQ4ebAzR05INZaiYP8N+ISZqgSzHK7Hvtq
+43xxfrkujoRm4bnQJZpvnRnmfujY8MUjFppoLB1Vro6Q7o7sXkadYFIyFyhZxEkq
+ID6Vxd/2PffFz7HCyXb4Pb70Y/wqAG+ZpratNe7exeCXxnPuM6Co/EyP8oxh+wMZ
+oegXTuMhWM7+8l+73U/3GMs1V93lUCp7GukS8noRsUO5cAcMj2m55aXJ4huWdBH1
+lblYwL03+ygqvYSxK2dCgsOVVUXV6sOKQjpDF17N0ur832fs4WyoAxmyHUpfT+fT
+4IbFGhDDCNLthZMIUQWmNxUyvWxzYwFdW09q3G0dVZEh5I638IECggEBAP0nyP52
+XIkyy4oih2FIkUoFraRcispcAoh+UcVmkCyj7adDGQuiQrTg4EW//qDydQuOfZ1z
+Z9MQCcXZjK06ZHKtljWRD0vJvU9lR6Yt6z/imXJmEu3r0nz/OiA3KtNlUZvDqhix
+H26dQEekH4Kb21Brhi/7PzG5gREEFGOGT0Aq9fl8oXgZE9BRUQ95iI0Uo962MylC
+uehZdvdDGram3wrBQsc/HH5cLJFLHvhGkR/uVrMOyNAx0z3tPdnFMAxY2Le17BSs
+QWRt5MZZ/RQFYGXYxIREfhu0pBZ1wSeWshnWOVTAk/PXH80b3/gSiBSfmAVHRnGB
+bN+R71PjxbGJL+ECggEBAPiTSih3lO/pxArD6FJZth2NzhTnQ8btCSdd844Iahlr
+LJebiFMr2v5LlGaE1anOpUNw+wFab8330Z1R7qDcRvV9p+6ghreD/yGLdgV93sQm
+Nry0ikjDBpCX5aY4w+Z80Pgj0jMfgcPjfYVaOBAD5ojbyEzQ97JNJzOFzTp0g2uC
+WNnf7vXT6f4c7wYSFtFMrlRLDRq94s9Ws3S+RE+kcwqYjWGEOEbclc8/a+dlhwK/
+S1fiPcQrHIIdzBN/wAYSjG+XUHuMgcMjFetwB46hBx5Z+hDKfg/iu+6GJh5VuZhm
+hewnxdljjVF3qqA2VTMQIV7sR2dx0a/8PlD1vtaS5wsCggEAIXyKxMYpVWinrd0F
+ZWPw/AamQnCPV1c2apGzBVacyZrhi9d/T5+mDUEVyYQtDWMlAmNV0Gb8m9mqQUaW
+qi9oLBc0IF/Q0yibZw4xnRTD4o55170S0e/4xtoH+Uzy2EW1ttH6BQwg6UPZxeA6
+3s75ArlGZcBpSo2MOhD9FXEluIo2QUswHK/MhCjNfSuJWYgaaRJW0CVobAixiOGS
+fgiyxjxsNejuPvS4XHvAW/0Ro1SmmUbiX0/H7pAcN1szEN8Lw7lHwjBK8hrrQSWU
+KXrQlohG7mwU9ls9vU7UPwVbB7njmYdjysRxC3Ode7YP1BKMTF5yPf9txGEMdF9T
+vjk0YQKCAQBf8vKwFiCOTsyWXzKA/xH17HO8y9v0oDBlWrWVgJf7wcvPpYCEoiwA
+9omM3P9gcVyHYMfyqMb5WQw3TpXuz7gwMFWvHZWCptfHSf6/deuUCTAdvQ6XsXgK
+Piet9sFfaZR8A8+yXhoH0/ryi3WScP7+mt+BDzRdRby4/Y/PXYQQ7pp/Vxn1F9x9
+cwusazUViyTLcsDXLq6q28ufZ4YUu+SQFXyVRKU4bRMCkXeENUNdAxwBC1pOK1nw
+u7G3YRts/KHqvRya5Ax+lz9xxqeUHYIS7CZDbvYkCaADHRL/qJVgR0qwclXDaNL2
+vFtHRlGyySooasnRGzUWWiZvt7v3NXMrAoIBAFa62ALXSzBeGx4v8w288QVqaErh
+6rPeYYyJRLpjXt8FJDJxZRo2L7wHdaPOnlKSlU0/yQa8oRQzN5WrmusE9hXDmxBW
+U6Io8mjafZdSY6ybVqmrLh6eAXD/K20MS6bDOrPRp0teSS6V1mquWBNmjy+T5G6L
++pQwPuyWq0YgPsUwtOtBADlgHeEgzjFwFznLdlZsVXuQILw5slvRKG8MT0VrgsRX
+Iww/Py2Dsz2O+Rrad1Qu/hYuupndyrPR2LuH4dCp1OaP6AA+SYrdpjKRADExIZgY
+lMktJwW3mwkuu12/Z+gO0UR1gB0KIY+VdrD8GTz/kuoBRYnRTv5NK0sY5s4=
+-----END RSA PRIVATE KEY-----

certs/renewcerts.sh

@@ -166,6 +166,25 @@ run_renewcerts(){
     echo "End of section"
     echo "---------------------------------------------------------------------"
     ############################################################
+    #### update the self-signed (4096-bit) client-cert.pem #####
+    ############################################################
+    echo "Updating 4096-bit client-cert.pem"
+    echo ""
+    #pipe the following arguments to openssl req...
+    echo -e "US\\nMontana\\nBozeman\\nwolfSSL_4096\\nProgramming-4096\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ./4096/client-key.pem -config ./wolfssl.cnf -nodes -out ./4096/client-cert.csr
+    check_result $? "Step 1"
+
+
+    openssl x509 -req -in ./4096/client-cert.csr -days 1000 -extfile wolfssl.cnf -extensions wolfssl_opts -signkey ./4096/client-key.pem -out ./4096/client-cert.pem
+    check_result $? "Step 2"
+    rm ./4096/client-cert.csr
+
+    openssl x509 -in ./4096/client-cert.pem -text > ./4096/tmp.pem
+    check_result $? "Step 3"
+    mv ./4096/tmp.pem ./4096/client-cert.pem
+    echo "End of section"
+    echo "---------------------------------------------------------------------"
+    ############################################################
     ########## update the self-signed ca-cert.pem ##############
     ############################################################
     echo "Updating ca-cert.pem"

configure.ac

@@ -4082,6 +4082,11 @@ do
     AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NO_2048"
     ;;
 
+  +4096)
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_4096"
+    AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_4096"
+    ;;
+
   *)
     AC_MSG_ERROR([Invalid choice of Single Precision length in bits [256, 2048, 3072]: $ENABLED_SP.])
     break;;

wolfcrypt/src/dh.c

@@ -1244,6 +1244,10 @@ static int GeneratePublicDh(DhKey* key, byte* priv, word32 privSz,
     if (mp_count_bits(&key->p) == 3072)
         return sp_DhExp_3072(&key->g, priv, privSz, &key->p, pub, pubSz);
 #endif
+#ifdef WOLFSSL_SP_4096
+    if (mp_count_bits(&key->p) == 4096)
+        return sp_DhExp_4096(&key->g, priv, privSz, &key->p, pub, pubSz);
+#endif
 #endif
 
 #ifndef WOLFSSL_SP_MATH
@@ -1477,6 +1481,14 @@ int wc_DhCheckPubKey_ex(DhKey* key, const byte* pub, word32 pubSz,
         }
         else
 #endif
+#ifdef WOLFSSL_SP_NO_4096
+        if (mp_count_bits(&key->p) == 4096) {
+            ret = sp_ModExp_4096(y, q, p, y);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
 #endif
 
         {
@@ -1756,6 +1768,14 @@ int wc_DhCheckKeyPair(DhKey* key, const byte* pub, word32 pubSz,
         }
         else
 #endif
+#ifdef WOLFSSL_SP_4096
+        if (mp_count_bits(&key->p) == 4096) {
+            ret = sp_ModExp_4096(&key->g, privateKey, &key->p, checkKey);
+            if (ret != 0)
+                ret = MP_EXPTMOD_E;
+        }
+        else
+#endif
 #endif
         {
 #ifndef WOLFSSL_SP_MATH
@@ -1905,6 +1925,28 @@ static int wc_DhAgree_Sync(DhKey* key, byte* agree, word32* agreeSz,
         return ret;
     }
 #endif
+#ifdef WOLFSSL_SP_4096
+    if (mp_count_bits(&key->p) == 4096) {
+        if (mp_init(y) != MP_OKAY)
+            return MP_INIT_E;
+
+        if (ret == 0 && mp_read_unsigned_bin(y, otherPub, pubSz) != MP_OKAY)
+            ret = MP_READ_E;
+
+        if (ret == 0)
+            ret = sp_DhExp_4096(y, priv, privSz, &key->p, agree, agreeSz);
+
+        mp_clear(y);
+    #ifdef WOLFSSL_SMALL_STACK
+    #ifndef WOLFSSL_SP_MATH
+        XFREE(z, key->heap, DYNAMIC_TYPE_DH);
+        XFREE(x, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        XFREE(y, key->heap, DYNAMIC_TYPE_DH);
+    #endif
+        return ret;
+    }
+#endif
 #endif
 
 #ifndef WOLFSSL_SP_MATH

wolfcrypt/src/integer.c

@@ -86,6 +86,8 @@ WOLFSSL_LOCAL int sp_ModExp_2048(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
 WOLFSSL_LOCAL int sp_ModExp_3072(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
+WOLFSSL_LOCAL int sp_ModExp_4096(mp_int* base, mp_int* exp, mp_int* mod,
+    mp_int* res);
 #ifdef __cplusplus
     } /* extern "C" */
 #endif
@@ -4632,6 +4634,11 @@ static int mp_prime_miller_rabin (mp_int * a, mp_int * b, int *result)
       err = sp_ModExp_3072(b, &r, a, &y);
   else
 #endif
+#ifdef WOLFSSL_SP_4096
+  if (mp_count_bits(a) == 4096)
+      err = sp_ModExp_4096(b, &r, a, &y);
+  else
+#endif
 #endif
       err = mp_exptmod (b, &r, a, &y);
   if (err != MP_OKAY)

wolfcrypt/src/rsa.c

@@ -629,6 +629,17 @@ int wc_CheckRsaKey(RsaKey* key)
     }
     else
 #endif
+#ifdef WOLFSSL_SP_4096
+    if (mp_count_bits(&key->n) == 4096) {
+        ret = sp_ModExp_4096(k, &key->e, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+        ret = sp_ModExp_4096(tmp, &key->d, &key->n, tmp);
+        if (ret != 0)
+            ret = MP_EXPTMOD_E;
+    }
+    else
+#endif
 #endif
 #ifdef WOLFSSL_SP_MATH
     {
@@ -2063,6 +2074,31 @@ static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
         }
     }
 #endif
+#ifdef WOLFSSL_SP_4096
+    if (mp_count_bits(&key->n) == 4096) {
+        switch(type) {
+#ifndef WOLFSSL_RSA_PUBLIC_ONLY
+        case RSA_PRIVATE_DECRYPT:
+        case RSA_PRIVATE_ENCRYPT:
+    #ifdef WC_RSA_BLINDING
+            if (rng == NULL)
+                return MISSING_RNG_E;
+    #endif
+    #ifndef RSA_LOW_MEM
+            return sp_RsaPrivate_4096(in, inLen, &key->d, &key->p, &key->q,
+                                      &key->dP, &key->dQ, &key->u, &key->n,
+                                      out, outLen);
+    #else
+            return sp_RsaPrivate_4096(in, inLen, &key->d, &key->p, &key->q,
+                                      NULL, NULL, NULL, &key->n, out, outLen);
+    #endif
+#endif
+        case RSA_PUBLIC_ENCRYPT:
+        case RSA_PUBLIC_DECRYPT:
+            return sp_RsaPublic_4096(in, inLen, &key->e, &key->n, out, outLen);
+        }
+    }
+#endif
 #endif /* WOLFSSL_HAVE_SP_RSA */
 
 #ifdef WOLFSSL_SP_MATH
@@ -3971,6 +4007,13 @@ int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
         XFREE(buf, key->heap, DYNAMIC_TYPE_RSA);
     }
 
+    if (err == MP_OKAY && mp_cmp(&p, &q) < 0) {
+        err = mp_copy(&p, &tmp1);
+        if (err == MP_OKAY)
+            err = mp_copy(&q, &p);
+        if (err == MP_OKAY)
+            mp_copy(&tmp1, &q);
+    }
 
     /* Setup RsaKey buffers */
     if (err == MP_OKAY)

wolfcrypt/src/tfm.c

@@ -78,6 +78,8 @@ WOLFSSL_LOCAL int sp_ModExp_2048(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
 WOLFSSL_LOCAL int sp_ModExp_3072(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
+WOLFSSL_LOCAL int sp_ModExp_4096(mp_int* base, mp_int* exp, mp_int* mod,
+    mp_int* res);
 #ifdef __cplusplus
     } /* extern "C" */
 #endif
@@ -3949,6 +3951,11 @@ static int fp_prime_miller_rabin_ex(fp_int * a, fp_int * b, int *result,
       sp_ModExp_3072(b, r, a, y);
   else
 #endif
+#ifdef WOLFSSL_SP_4096
+  if (fp_count_bits(a) == 4096)
+      sp_ModExp_4096(b, r, a, y);
+  else
+#endif
 #endif
       fp_exptmod(b, r, a, y);
 

wolfssl/wolfcrypt/sp.h

@@ -62,6 +62,12 @@ WOLFSSL_LOCAL int sp_RsaPrivate_3072(const byte* in, word32 inLen,
     mp_int* dm, mp_int* pm, mp_int* qm, mp_int* dpm, mp_int* dqm, mp_int* qim,
     mp_int* mm, byte* out, word32* outLen);
 
+WOLFSSL_LOCAL int sp_RsaPublic_4096(const byte* in, word32 inLen,
+    mp_int* em, mp_int* mm, byte* out, word32* outLen);
+WOLFSSL_LOCAL int sp_RsaPrivate_4096(const byte* in, word32 inLen,
+    mp_int* dm, mp_int* pm, mp_int* qm, mp_int* dpm, mp_int* dqm, mp_int* qim,
+    mp_int* mm, byte* out, word32* outLen);
+
 #endif /* WOLFSSL_HAVE_SP_RSA */
 
 #if defined(WOLFSSL_HAVE_SP_DH) || defined(WOLFSSL_HAVE_SP_RSA)
@@ -74,6 +80,8 @@ WOLFSSL_LOCAL int sp_ModExp_2048(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
 WOLFSSL_LOCAL int sp_ModExp_3072(mp_int* base, mp_int* exp, mp_int* mod,
     mp_int* res);
+WOLFSSL_LOCAL int sp_ModExp_4096(mp_int* base, mp_int* exp, mp_int* mod,
+    mp_int* res);
 
 #endif
 
@@ -83,6 +91,8 @@ WOLFSSL_LOCAL int sp_DhExp_2048(mp_int* base, const byte* exp, word32 expLen,
     mp_int* mod, byte* out, word32* outLen);
 WOLFSSL_LOCAL int sp_DhExp_3072(mp_int* base, const byte* exp, word32 expLen,
     mp_int* mod, byte* out, word32* outLen);
+WOLFSSL_LOCAL int sp_DhExp_4096(mp_int* base, const byte* exp, word32 expLen,
+    mp_int* mod, byte* out, word32* outLen);
 
 #endif /* WOLFSSL_HAVE_SP_DH */
 

wolfssl/wolfcrypt/sp_int.h

@@ -105,18 +105,24 @@
     #else
         #define SP_INT_DIGITS        ((256 + SP_WORD_SIZE) / SP_WORD_SIZE)
     #endif
-#elif defined(WOLFSSL_SP_NO_3072)
+#elif defined(WOLFSSL_SP_4096)
     #if defined(WOLFSSL_HAVE_SP_DH) && defined(WOLFSSL_KEY_GEN)
-        #define SP_INT_DIGITS        ((4096 + SP_WORD_SIZE) / SP_WORD_SIZE)
+        #define SP_INT_DIGITS        ((8192 + SP_WORD_SIZE) / SP_WORD_SIZE)
     #else
-        #define SP_INT_DIGITS        ((2048 + SP_WORD_SIZE) / SP_WORD_SIZE)
+        #define SP_INT_DIGITS        ((4096 + SP_WORD_SIZE) / SP_WORD_SIZE)
     #endif
-#else
+#elif !defined(WOLFSSL_SP_NO_3072)
     #if defined(WOLFSSL_HAVE_SP_DH) && defined(WOLFSSL_KEY_GEN)
         #define SP_INT_DIGITS        ((6144 + SP_WORD_SIZE) / SP_WORD_SIZE)
     #else
         #define SP_INT_DIGITS        ((3072 + SP_WORD_SIZE) / SP_WORD_SIZE)
     #endif
+#else
+    #if defined(WOLFSSL_HAVE_SP_DH) && defined(WOLFSSL_KEY_GEN)
+        #define SP_INT_DIGITS        ((4096 + SP_WORD_SIZE) / SP_WORD_SIZE)
+    #else
+        #define SP_INT_DIGITS        ((2048 + SP_WORD_SIZE) / SP_WORD_SIZE)
+    #endif
 #endif
 
 #define sp_isodd(a)  ((a)->used != 0 && ((a)->dp[0] & 1))