*error = "rsa_verify failed";
static int loadrsakey_main(FILE * fp, struct RSAKey *key, int pub_only,			   char **commentptr, char *passphrase){    unsigned char buf[16384];    unsigned char keybuf[16];    int len;    int i, j, ciphertype;    int ret = 0;    struct MD5Context md5c;    char *comment;    /* Slurp the whole file (minus the header) into a buffer. */    len = fread(buf, 1, sizeof(buf), fp);    fclose(fp);    if (len < 0 || len == sizeof(buf))	goto end;		       /* file too big or not read */    i = 0;    /*     * A zero byte. (The signature includes a terminating NUL.)     */    if (len - i < 1 || buf[i] != 0)	goto end;    i++;    /* One byte giving encryption type, and one reserved uint32. */    if (len - i < 1)	goto end;    ciphertype = buf[i];    if (ciphertype != 0 && ciphertype != SSH_CIPHER_3DES)	goto end;    i++;    if (len - i < 4)	goto end;		       /* reserved field not present */    if (buf[i] != 0 || buf[i + 1] != 0 || buf[i + 2] != 0	|| buf[i + 3] != 0) goto end;  /* reserved field nonzero, panic! */    i += 4;    /* Now the serious stuff. An ordinary SSH 1 public key. */    i += makekey(buf + i, key, NULL, 1);    if (len - i < 0)	goto end;		       /* overran */    if (pub_only) {	ret = 1;	goto end;    }    /* Next, the comment field. */    j = GET_32BIT(buf + i);    i += 4;    if (len - i < j)	goto end;    comment = snewn(j + 1, char);    if (comment) {	memcpy(comment, buf + i, j);	comment[j] = '\0';    }    i += j;    if (commentptr)	*commentptr = comment;    if (key)	key->comment = comment;    if (!key) {	return ciphertype != 0;    }    /*     * Decrypt remainder of buffer.     */    if (ciphertype) {	MD5Init(&md5c);	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));	MD5Final(keybuf, &md5c);	des3_decrypt_pubkey(keybuf, buf + i, (len - i + 7) & ~7);	memset(keybuf, 0, sizeof(keybuf));	/* burn the evidence */    }    /*     * We are now in the secret part of the key. The first four     * bytes should be of the form a, b, a, b.     */    if (len - i < 4)	goto end;    if (buf[i] != buf[i + 2] || buf[i + 1] != buf[i + 3]) {	ret = -1;	goto end;    }    i += 4;    /*     * After that, we have one further bignum which is our     * decryption exponent, and then the three auxiliary values     * (iqmp, q, p).     */    i += makeprivate(buf + i, key);    if (len - i < 0)	goto end;    i += ssh1_read_bignum(buf + i, &key->iqmp);    if (len - i < 0)	goto end;    i += ssh1_read_bignum(buf + i, &key->q);    if (len - i < 0)	goto end;    i += ssh1_read_bignum(buf + i, &key->p);    if (len - i < 0)	goto end;    if (!rsa_verify(key)) {	freersakey(key);	ret = 0;    } else	ret = 1;  end:    memset(buf, 0, sizeof(buf));       /* burn the evidence */    return ret;}