fix: bind RSA public exponent to fixed values [LA-E]

[x-senpai-x]

Summary

Fixes LA-E: Unbound RSA Exponent Witness Enables Forged Passport Signature Verification.

A malicious prover could supply exponent = 1 (or any arbitrary value) as a
free witness. With e = 1, RSA verification degenerates to sig^1 mod n = sig,
so a prover can forge a valid PKCS#1 v1.5 message without knowledge of any
private key.

Changes

DSC → SOD path (t_add_id_data_720, t_add_id_data_1300)

• verify_rsa_pubkey_in_tbs now accepts exponent and exponent_offset_in_dsc_cert
  as inputs and byte-compares the claimed exponent value against the authenticated
  TBS certificate bytes at the given offset, mirroring the existing modulus check.
• The TBS certificate is authenticated by the preceding CSCA signature step, so
  the prover cannot alter its bytes.

CSC → DSC path (t_add_dsc_720, t_add_dsc_verify_1300)

• The CSCA exponent is now included in compute_key_ne_hash, which produces a
  Poseidon2 hash over (modulus || exponent) asserted against the public input
  csc_key_ne_hash. The prover cannot substitute an alternative exponent without
  invalidating this commitment.

Exponent allowlist (assert_allowed_rsa_exponent)

• Added to both verify_rsa_pubkey_in_tbs and compute_key_ne_hash, blocking
  e = 1, e = 2, and all values outside the set of known ICAO-compliant
  exponents {3, 38129, 56611, 65537, 107903, 109729, 122125, 130689}.

[Copilot]

Pull request overview

Addresses LA-E by preventing prover-controlled RSA public exponents from bypassing signature verification (e.g., e = 1), ensuring e is either authenticated from certificate bytes or committed via a public hash.

Changes:

• Introduces an RSA exponent allowlist (assert_allowed_rsa_exponent) and enforces it in RSA verification helpers.
• Binds e in the DSC→SOD path by byte-comparing the claimed exponent against the authenticated TBS certificate bytes at a prover-supplied offset.
• Binds e in the CSCA→DSC path by adding a Poseidon2 commitment over (n || e) and asserting it against a new public input csc_key_ne_hash.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
noir-examples/noir-passport/utils/sig-check/rsa/src/lib.nr	Adds `(n
noir-examples/noir-passport/utils/sig-check/rsa/Nargo.toml	Adds Poseidon dependency for the new key commitment hash.
noir-examples/noir-passport/utils/sig-check/fragmented-rsa/src/lib.nr	Enforces exponent allowlist in fragmented RSA verification.
noir-examples/noir-passport/utils/sig-check/fragmented-rsa/Nargo.toml	Adds dependency on common for exponent allowlist.
noir-examples/noir-passport/utils/sig-check/common/src/lib.nr	Introduces assert_allowed_rsa_exponent allowlist helper.
noir-examples/noir-passport/utils/data-check/tbs-pubkey/src/lib.nr	Extends TBS pubkey check to also authenticate exponent bytes at an offset.
noir-examples/noir-passport/utils/data-check/tbs-pubkey/Nargo.toml	Renames package and adds common dependency.
noir-examples/noir-passport/merkle_age_check/t_add_id_data_720/src/main.nr	Adds exponent + exponent-offset inputs and checks exponent bytes in TBS.
noir-examples/noir-passport/merkle_age_check/t_add_id_data_1300/src/main.nr	Adds exponent + exponent-offset inputs and checks exponent bytes in TBS.
noir-examples/noir-passport/merkle_age_check/t_add_dsc_verify_1300/src/main.nr	Adds public csc_key_ne_hash and asserts it equals `H(n
noir-examples/noir-passport/merkle_age_check/t_add_dsc_verify_1300/Nargo.toml	Adds dependency on sig_check_rsa for compute_key_ne_hash.
noir-examples/noir-passport/merkle_age_check/t_add_dsc_720/src/main.nr	Adds public csc_key_ne_hash and asserts it equals `H(n
noir-examples/noir-passport/merkle_age_check/benchmark-inputs/tbs_720/t_add_id_data_720.toml	Adds exponent + exponent offset proving inputs.
noir-examples/noir-passport/merkle_age_check/benchmark-inputs/tbs_720/t_add_dsc_720.toml	Adds csc_key_ne_hash public input.
noir-examples/noir-passport/merkle_age_check/benchmark-inputs/tbs_1300/t_add_id_data_1300.toml	Adds exponent + exponent offset proving inputs.
noir-examples/noir-passport/merkle_age_check/benchmark-inputs/tbs_1300/t_add_dsc_verify_1300.toml	Adds csc_key_ne_hash public input.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.