refactor: remove redundant heap allocation in OAEP decrypt_inner

[radik878]

[decrypt_inner]

RSA/src/algorithms/oaep.rs

Lines 213 to 263 in 16d8eaf

	/// Decrypts OAEP padding. It returns one or zero in valid that indicates whether the
	/// plaintext was correctly structured.
	#[inline]
	fn decrypt_inner<MGF: FnMut(&mut [u8], &mut [u8])>(
	em: &mut [u8],
	h_size: usize,
	expected_p_hash: &[u8],
	k: usize,
	mut mgf: MGF,
	) -> Result<CtOption<(Vec<u8>, u32)>> {
	if k < 11 {
	return Err(Error::Decryption);
	}
	if k < h_size * 2 + 2 {
	return Err(Error::Decryption);
	}
	let first_byte_is_zero = em[0].ct_eq(&0u8);
	let (_, payload) = em.split_at_mut(1);
	let (seed, db) = payload.split_at_mut(h_size);
	mgf(seed, db);
	let hash_are_equal = db[0..h_size].ct_eq(expected_p_hash);
	// The remainder of the plaintext must be zero or more 0x00, followed
	// by 0x01, followed by the message.
	// looking_for_index: 1 if we are still looking for the 0x01
	// index: the offset of the first 0x01 byte
	// zero_before_one: 1 if we saw a non-zero byte before the 1
	let mut looking_for_index = Choice::TRUE;
	let mut index = 0u32;
	let mut nonzero_before_one = Choice::FALSE;
	for (i, el) in db.iter().skip(h_size).enumerate() {
	let equals0 = el.ct_eq(&0u8);
	let equals1 = el.ct_eq(&1u8);
	index.ct_assign(&(i as u32), looking_for_index & equals1);
	looking_for_index &= !equals1;
	nonzero_before_one |= looking_for_index & !equals0;
	}
	let valid = first_byte_is_zero & hash_are_equal & !nonzero_before_one & !looking_for_index;
	Ok(CtOption::new(
	(em.to_vec(), index + 2 + (h_size * 2) as u32),
	valid,
	))
	}

took em by reference but cloned it via em.to_vec() into the returned CtOption<(Vec<u8>, u32)>. The caller then allocated again with out[index..].to_vec(). Two heap allocations per decryption instead of one.

Unlike PKCS#1 v1.5 which takes Vec<u8> by value, OAEP was forced to clone due to borrowing. The clone was useless—the caller already had em.

Changed return type from CtOption<(Vec<u8>, u32)> to CtOption<u32> (index only). Callers now use em directly. One allocation removed; behavior and constant-time properties unchanged.