/* * Check a private RSA key */ int rsa_check_privkey( const rsa_context *ctx ) { int ret; mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP; if( ( ret = rsa_check_pubkey( ctx ) ) != 0 ) return( ret ); if( !ctx->P.p || !ctx->Q.p || !ctx->D.p ) return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); mpi_init( &PQ ); mpi_init( &DE ); mpi_init( &P1 ); mpi_init( &Q1 ); mpi_init( &H ); mpi_init( &I ); mpi_init( &G ); mpi_init( &G2 ); mpi_init( &L1 ); mpi_init( &L2 ); mpi_init( &DP ); mpi_init( &DQ ); mpi_init( &QP ); MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) ); MPI_CHK( mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) ); MPI_CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); MPI_CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); MPI_CHK( mpi_gcd( &G, &ctx->E, &H ) ); MPI_CHK( mpi_gcd( &G2, &P1, &Q1 ) ); MPI_CHK( mpi_div_mpi( &L1, &L2, &H, &G2 ) ); MPI_CHK( mpi_mod_mpi( &I, &DE, &L1 ) ); MPI_CHK( mpi_mod_mpi( &DP, &ctx->D, &P1 ) ); MPI_CHK( mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) ); MPI_CHK( mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) ); /* * Check for a valid PKCS1v2 private key */ if( mpi_cmp_mpi( &PQ, &ctx->N ) != 0 || mpi_cmp_mpi( &DP, &ctx->DP ) != 0 || mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 || mpi_cmp_mpi( &QP, &ctx->QP ) != 0 || mpi_cmp_int( &L2, 0 ) != 0 || mpi_cmp_int( &I, 1 ) != 0 || mpi_cmp_int( &G, 1 ) != 0 ) { ret = POLARSSL_ERR_RSA_KEY_CHECK_FAILED; } cleanup: mpi_free( &PQ ); mpi_free( &DE ); mpi_free( &P1 ); mpi_free( &Q1 ); mpi_free( &H ); mpi_free( &I ); mpi_free( &G ); mpi_free( &G2 ); mpi_free( &L1 ); mpi_free( &L2 ); mpi_free( &DP ); mpi_free( &DQ ); mpi_free( &QP ); if( ret == POLARSSL_ERR_RSA_KEY_CHECK_FAILED ) return( ret ); if( ret != 0 ) return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED + ret ); return( 0 ); }
/* * Check a private RSA key */ int rsa_check_privkey( rsa_context *ctx ) { int ret; mpi PQ, DE, P1, Q1, H, I, G; if( ( ret = rsa_check_pubkey( ctx ) ) != 0 ) return( ret ); if( !ctx->P.p || !ctx->Q.p || !ctx->D.p ) return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); mpi_init( &PQ, &DE, &P1, &Q1, &H, &I, &G, NULL ); MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) ); MPI_CHK( mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) ); MPI_CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); MPI_CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); MPI_CHK( mpi_mod_mpi( &I, &DE, &H ) ); MPI_CHK( mpi_gcd( &G, &ctx->E, &H ) ); if( mpi_cmp_mpi( &PQ, &ctx->N ) == 0 && mpi_cmp_int( &I, 1 ) == 0 && mpi_cmp_int( &G, 1 ) == 0 ) { mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, NULL ); return( 0 ); } cleanup: mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, NULL ); return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED | ret ); }
/* * Check if the private key is valid */ int rsa_check_privkey( rsa_context *ctx ) { int ret = 0; mpi TN, P1, Q1, H, G; mpi_init( &TN, &P1, &Q1, &H, &G, NULL ); CHK( mpi_mul_mpi( &TN, &ctx->P, &ctx->Q ) ); CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); CHK( mpi_gcd( &G, &ctx->E, &H ) ); if( mpi_cmp_mpi( &TN, &ctx->N ) == 0 && mpi_cmp_int( &G, 1 ) == 0 ) { mpi_free( &TN, &P1, &Q1, &H, &G, NULL ); return( 0 ); } cleanup: mpi_free( &TN, &P1, &Q1, &H, &G, NULL ); return( ERR_RSA_KEY_CHK_FAILED | ret ); }
/* * Generate an RSA keypair */ int rsa_gen_key( rsa_context *ctx, int nbits, int exponent, ulong (*rng_fn)(void *), void *rng_st ) { int ret; mpi P1, Q1, H, G; mpi_init( &P1, &Q1, &H, &G, NULL ); memset( ctx, 0, sizeof( rsa_context ) ); /* * find primes P and Q with Q < P so that: * GCD( E, (P-1)*(Q-1) ) == 1 */ CHK( mpi_lset( &ctx->E, exponent ) ); nbits >>= 1; do { CHK( mpi_gen_prime( &ctx->P, nbits, 0, rng_fn, rng_st ) ); CHK( mpi_gen_prime( &ctx->Q, nbits, 0, rng_fn, rng_st ) ); if( mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 ) mpi_swap( &ctx->P, &ctx->Q ); CHK( mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) ); CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); CHK( mpi_gcd( &G, &ctx->E, &H ) ); } while( mpi_cmp_int( &G, 1 ) != 0 ); /* * D = E^-1 mod ((P-1)*(Q-1)) * DP = D mod (P - 1) * DQ = D mod (Q - 1) * QP = Q^-1 mod P */ CHK( mpi_inv_mod( &ctx->D , &ctx->E, &H ) ); CHK( mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) ); CHK( mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) ); CHK( mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) ); ctx->len = ( mpi_size( &ctx->N ) + 7 ) >> 3; cleanup: mpi_free( &P1, &Q1, &H, &G, NULL ); if( ret != 0 ) { rsa_free( ctx ); return( ERR_RSA_KEYGEN_FAILED | ret ); } return( 0 ); }
static int Bgcd(lua_State *L) { mpi *a=Bget(L,1); mpi *b=Bget(L,2); mpi *c=Bnew(L); mpi_gcd(c,a,b); return 1; }
/* Generate an RSA keypair */ int rsa_gen_key(rsa_context *ctx, int nbits, int exponent) { mpi P1, Q1, H, G; int ret; if (ctx->f_rng == NULL || nbits < 128 || exponent < 3) { return EST_ERR_RSA_BAD_INPUT_DATA; } mpi_init(&P1, &Q1, &H, &G, NULL); /* find primes P and Q with Q < P so that: GCD( E, (P-1)*(Q-1) ) == 1 */ MPI_CHK(mpi_lset(&ctx->E, exponent)); do { MPI_CHK(mpi_gen_prime(&ctx->P, (nbits + 1) >> 1, 0, ctx->f_rng, ctx->p_rng)); MPI_CHK(mpi_gen_prime(&ctx->Q, (nbits + 1) >> 1, 0, ctx->f_rng, ctx->p_rng)); if (mpi_cmp_mpi(&ctx->P, &ctx->Q) < 0) { mpi_swap(&ctx->P, &ctx->Q); } if (mpi_cmp_mpi(&ctx->P, &ctx->Q) == 0) { continue; } MPI_CHK(mpi_mul_mpi(&ctx->N, &ctx->P, &ctx->Q)); if (mpi_msb(&ctx->N) != nbits) { continue; } MPI_CHK(mpi_sub_int(&P1, &ctx->P, 1)); MPI_CHK(mpi_sub_int(&Q1, &ctx->Q, 1)); MPI_CHK(mpi_mul_mpi(&H, &P1, &Q1)); MPI_CHK(mpi_gcd(&G, &ctx->E, &H)); } while (mpi_cmp_int(&G, 1) != 0); /* D = E^-1 mod ((P-1)*(Q-1)) DP = D mod (P - 1) DQ = D mod (Q - 1) QP = Q^-1 mod P */ MPI_CHK(mpi_inv_mod(&ctx->D, &ctx->E, &H)); MPI_CHK(mpi_mod_mpi(&ctx->DP, &ctx->D, &P1)); MPI_CHK(mpi_mod_mpi(&ctx->DQ, &ctx->D, &Q1)); MPI_CHK(mpi_inv_mod(&ctx->QP, &ctx->Q, &ctx->P)); ctx->len = (mpi_msb(&ctx->N) + 7) >> 3; cleanup: mpi_free(&G, &H, &Q1, &P1, NULL); if (ret != 0) { rsa_free(ctx); return EST_ERR_RSA_KEY_GEN_FAILED | ret; } return 0; }
/* * Check a private RSA key */ int rsa_check_privkey( const rsa_context *ctx ) { int ret; mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2; if( ( ret = rsa_check_pubkey( ctx ) ) != 0 ) return( ret ); if( !ctx->P.p || !ctx->Q.p || !ctx->D.p ) return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED ); mpi_init( &PQ, &DE, &P1, &Q1, &H, &I, &G, &G2, &L1, &L2, NULL ); MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) ); MPI_CHK( mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) ); MPI_CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); MPI_CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); MPI_CHK( mpi_gcd( &G, &ctx->E, &H ) ); MPI_CHK( mpi_gcd( &G2, &P1, &Q1 ) ); MPI_CHK( mpi_div_mpi( &L1, &L2, &H, &G2 ) ); MPI_CHK( mpi_mod_mpi( &I, &DE, &L1 ) ); /* * Check for a valid PKCS1v2 private key */ if( mpi_cmp_mpi( &PQ, &ctx->N ) == 0 && mpi_cmp_int( &L2, 0 ) == 0 && mpi_cmp_int( &I, 1 ) == 0 && mpi_cmp_int( &G, 1 ) == 0 ) { mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, &G2, &L1, &L2, NULL ); return( 0 ); } cleanup: mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, &G2, &L1, &L2, NULL ); return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED | ret ); }
static void do_gcd(void) { MPI a = mpi_alloc(40); if( stackidx < 2 ) { fputs("stack underflow\n", stderr); return; } mpi_gcd( a, stack[stackidx-2], stack[stackidx-1] ); mpi_set(stack[stackidx-2],a); mpi_free(a); stackidx--; }
static void do_gcd (void) { gcry_mpi_t a; if (stackidx < 2) { fputs ("stack underflow\n", stderr); return; } a = mpi_new (0); mpi_gcd (a, stack[stackidx - 2], stack[stackidx - 1]); mpi_set (stack[stackidx - 2], a); mpi_release (a); stackidx--; }
/* * Generate or update blinding values, see section 10 of: * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA, * DSS, and other systems. In : Advances in Cryptology—CRYPTO’96. Springer * Berlin Heidelberg, 1996. p. 104-113. */ static int rsa_prepare_blinding( rsa_context *ctx, mpi *Vi, mpi *Vf, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) { int ret, count = 0; #if defined(POLARSSL_THREADING_C) polarssl_mutex_lock( &ctx->mutex ); #endif if( ctx->Vf.p != NULL ) { /* We already have blinding values, just update them by squaring */ MPI_CHK( mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) ); MPI_CHK( mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) ); MPI_CHK( mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) ); MPI_CHK( mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) ); goto done; } /* Unblinding value: Vf = random number, invertible mod N */ do { if( count++ > 10 ) return( POLARSSL_ERR_RSA_RNG_FAILED ); MPI_CHK( mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) ); MPI_CHK( mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) ); } while( mpi_cmp_int( &ctx->Vi, 1 ) != 0 ); /* Blinding value: Vi = Vf^(-e) mod N */ MPI_CHK( mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) ); MPI_CHK( mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) ); done: if( Vi != &ctx->Vi ) { MPI_CHK( mpi_copy( Vi, &ctx->Vi ) ); MPI_CHK( mpi_copy( Vf, &ctx->Vf ) ); } cleanup: #if defined(POLARSSL_THREADING_C) polarssl_mutex_unlock( &ctx->mutex ); #endif return( ret ); }
void mpr_canonicalize(mpr *op) { mpi gcd; memset(&gcd, '\0', sizeof(mpi)); mpi_gcd(&gcd, mpr_num(op), mpr_den(op)); if (mpi_cmpabsi(&gcd, 1)) { mpi_div(mpr_num(op), mpr_num(op), &gcd); mpi_div(mpr_den(op), mpr_den(op), &gcd); } if (op->den.sign) { op->num.sign = !op->num.sign; op->den.sign = 0; } mpi_clear(&gcd); }
/* * Generate an RSA keypair */ int rsa_gen_key( rsa_context *ctx, int (*f_rng)(void *), void *p_rng, int nbits, int exponent ) { int ret; mpi P1, Q1, H, G; if( f_rng == NULL || nbits < 128 || exponent < 3 ) return( POLARSSL_ERR_RSA_BAD_INPUT_DATA ); mpi_init( &P1, &Q1, &H, &G, NULL ); /* * find primes P and Q with Q < P so that: * GCD( E, (P-1)*(Q-1) ) == 1 */ MPI_CHK( mpi_lset( &ctx->E, exponent ) ); do { MPI_CHK( mpi_gen_prime( &ctx->P, ( nbits + 1 ) >> 1, 0, f_rng, p_rng ) ); MPI_CHK( mpi_gen_prime( &ctx->Q, ( nbits + 1 ) >> 1, 0, f_rng, p_rng ) ); if( mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 ) mpi_swap( &ctx->P, &ctx->Q ); if( mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 ) continue; MPI_CHK( mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) ); if( mpi_msb( &ctx->N ) != nbits ) continue; MPI_CHK( mpi_sub_int( &P1, &ctx->P, 1 ) ); MPI_CHK( mpi_sub_int( &Q1, &ctx->Q, 1 ) ); MPI_CHK( mpi_mul_mpi( &H, &P1, &Q1 ) ); MPI_CHK( mpi_gcd( &G, &ctx->E, &H ) ); } while( mpi_cmp_int( &G, 1 ) != 0 ); /* * D = E^-1 mod ((P-1)*(Q-1)) * DP = D mod (P - 1) * DQ = D mod (Q - 1) * QP = Q^-1 mod P */ MPI_CHK( mpi_inv_mod( &ctx->D , &ctx->E, &H ) ); MPI_CHK( mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) ); MPI_CHK( mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) ); MPI_CHK( mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) ); ctx->len = ( mpi_msb( &ctx->N ) + 7 ) >> 3; cleanup: mpi_free( &G, &H, &Q1, &P1, NULL ); if( ret != 0 ) { rsa_free( ctx ); return( POLARSSL_ERR_RSA_KEY_GEN_FAILED | ret ); } return( 0 ); }
/**************** * Generate a random secret exponent k from prime p, so that k is * relatively prime to p-1. With SMALL_K set, k will be selected for * better encryption performance - this must never bee used signing! */ static MPI gen_k( MPI p, int small_k ) { MPI k = mpi_alloc_secure( 0 ); MPI temp = mpi_alloc( mpi_get_nlimbs(p) ); MPI p_1 = mpi_copy(p); unsigned int orig_nbits = mpi_get_nbits(p); unsigned int nbits; unsigned int nbytes; char *rndbuf = NULL; if (small_k) { /* Using a k much lesser than p is sufficient for encryption and * it greatly improves the encryption performance. We use * Wiener's table and add a large safety margin. */ nbits = wiener_map( orig_nbits ) * 3 / 2; if( nbits >= orig_nbits ) BUG(); } else nbits = orig_nbits; nbytes = (nbits+7)/8; if( DBG_CIPHER ) log_debug("choosing a random k of %u bits", nbits); mpi_sub_ui( p_1, p, 1); for(;;) { if( !rndbuf || nbits < 32 ) { xfree(rndbuf); rndbuf = get_random_bits( nbits, 1, 1 ); } else { /* Change only some of the higher bits. */ /* We could impprove this by directly requesting more memory * at the first call to get_random_bits() and use this the here * maybe it is easier to do this directly in random.c * Anyway, it is highly inlikely that we will ever reach this code */ char *pp = get_random_bits( 32, 1, 1 ); memcpy( rndbuf,pp, 4 ); xfree(pp); } mpi_set_buffer( k, rndbuf, nbytes, 0 ); for(;;) { if( !(mpi_cmp( k, p_1 ) < 0) ) { /* check: k < (p-1) */ if( DBG_CIPHER ) progress('+'); break; /* no */ } if( !(mpi_cmp_ui( k, 0 ) > 0) ) { /* check: k > 0 */ if( DBG_CIPHER ) progress('-'); break; /* no */ } if( mpi_gcd( temp, k, p_1 ) ) goto found; /* okay, k is relatively prime to (p-1) */ mpi_add_ui( k, k, 1 ); if( DBG_CIPHER ) progress('.'); } } found: xfree(rndbuf); if( DBG_CIPHER ) progress('\n'); mpi_free(p_1); mpi_free(temp); return k; }