static int
tfm_rsa_private_calculate(fp_int * in, fp_int * p, fp_int * q,
fp_int * dmp1, fp_int * dmq1, fp_int * iqmp,
fp_int * out)
{
fp_int vp, vq, u;
fp_init_multi(&vp, &vq, &u, NULL);
/* vq = c ^ (d mod (q - 1)) mod q */
/* vp = c ^ (d mod (p - 1)) mod p */
fp_mod(in, p, &u);
fp_exptmod(&u, dmp1, p, &vp);
fp_mod(in, q, &u);
fp_exptmod(&u, dmq1, q, &vq);
/* C2 = 1/q mod p (iqmp) */
/* u = (vp - vq)C2 mod p. */
fp_sub(&vp, &vq, &u);
if (fp_isneg(&u))
fp_add(&u, p, &u);
fp_mul(&u, iqmp, &u);
fp_mod(&u, p, &u);
/* c ^ d mod n = vq + u q */
fp_mul(&u, q, &u);
fp_add(&u, &vq, out);
fp_zero_multi(&vp, &vq, &u, NULL);
return 0;
}
static int
tfm_dh_compute_key(unsigned char *shared, const BIGNUM * pub, DH *dh)
{
fp_int s, priv_key, p, peer_pub;
size_t size = 0;
int ret;
if (dh->pub_key == NULL || dh->g == NULL || dh->priv_key == NULL)
return -1;
fp_init(&p);
BN2mpz(&p, dh->p);
fp_init(&peer_pub);
BN2mpz(&peer_pub, pub);
/* check if peers pubkey is reasonable */
if (fp_isneg(&peer_pub)
|| fp_cmp(&peer_pub, &p) >= 0
|| fp_cmp_d(&peer_pub, 1) <= 0)
{
fp_zero(&p);
fp_zero(&peer_pub);
return -1;
}
fp_init(&priv_key);
BN2mpz(&priv_key, dh->priv_key);
fp_init(&s);
ret = fp_exptmod(&peer_pub, &priv_key, &p, &s);
fp_zero(&p);
fp_zero(&peer_pub);
fp_zero(&priv_key);
if (ret != 0)
return -1;
size = fp_unsigned_bin_size(&s);
fp_to_unsigned_bin(&s, shared);
fp_zero(&s);
return size;
}
static int
tfm_rsa_private_decrypt(int flen, const unsigned char* from,
unsigned char* to, RSA* rsa, int padding)
{
unsigned char *ptr;
int res;
int size;
fp_int in, out, n, e;
if (padding != RSA_PKCS1_PADDING)
return -1;
size = RSA_size(rsa);
if (flen > size)
return -2;
fp_init_multi(&in, &out, NULL);
BN2mpz(&n, rsa->n);
BN2mpz(&e, rsa->e);
fp_read_unsigned_bin(&in, rk_UNCONST(from), flen);
if(fp_isneg(&in) || fp_cmp(&in, &n) >= 0) {
size = -2;
goto out;
}
if (rsa->p && rsa->q && rsa->dmp1 && rsa->dmq1 && rsa->iqmp) {
fp_int p, q, dmp1, dmq1, iqmp;
BN2mpz(&p, rsa->p);
BN2mpz(&q, rsa->q);
BN2mpz(&dmp1, rsa->dmp1);
BN2mpz(&dmq1, rsa->dmq1);
BN2mpz(&iqmp, rsa->iqmp);
res = tfm_rsa_private_calculate(&in, &p, &q, &dmp1, &dmq1, &iqmp, &out);
fp_zero_multi(&p, &q, &dmp1, &dmq1, &iqmp, NULL);
if (res != 0) {
size = -3;
goto out;
}
} else {
fp_int d;
if(fp_isneg(&in) || fp_cmp(&in, &n) >= 0)
return -4;
BN2mpz(&d, rsa->d);
res = fp_exptmod(&in, &d, &n, &out);
fp_zero(&d);
if (res != 0) {
size = -5;
goto out;
}
}
ptr = to;
{
size_t ssize;
ssize = fp_unsigned_bin_size(&out);
assert(size >= ssize);
fp_to_unsigned_bin(&out, ptr);
size = ssize;
}
/* head zero was skipped by mp_int_to_unsigned */
if (*ptr != 2) {
size = -6;
goto out;
}
size--; ptr++;
while (size && *ptr != 0) {
size--; ptr++;
}
if (size == 0)
return -7;
size--; ptr++;
memmove(to, ptr, size);
out:
fp_zero_multi(&e, &n, &in, &out, NULL);
return size;
}
static int
tfm_rsa_private_encrypt(int flen, const unsigned char* from,
unsigned char* to, RSA* rsa, int padding)
{
unsigned char *p, *p0;
int res;
int size;
fp_int in, out, n, e;
if (padding != RSA_PKCS1_PADDING)
return -1;
size = RSA_size(rsa);
if (size < RSA_PKCS1_PADDING_SIZE || size - RSA_PKCS1_PADDING_SIZE < flen)
return -2;
p0 = p = malloc(size);
*p++ = 0;
*p++ = 1;
memset(p, 0xff, size - flen - 3);
p += size - flen - 3;
*p++ = 0;
memcpy(p, from, flen);
p += flen;
assert((p - p0) == size);
BN2mpz(&n, rsa->n);
BN2mpz(&e, rsa->e);
fp_init_multi(&in, &out, NULL);
fp_read_unsigned_bin(&in, p0, size);
free(p0);
if(fp_isneg(&in) || fp_cmp(&in, &n) >= 0) {
size = -3;
goto out;
}
if (rsa->p && rsa->q && rsa->dmp1 && rsa->dmq1 && rsa->iqmp) {
fp_int p, q, dmp1, dmq1, iqmp;
BN2mpz(&p, rsa->p);
BN2mpz(&q, rsa->q);
BN2mpz(&dmp1, rsa->dmp1);
BN2mpz(&dmq1, rsa->dmq1);
BN2mpz(&iqmp, rsa->iqmp);
res = tfm_rsa_private_calculate(&in, &p, &q, &dmp1, &dmq1, &iqmp, &out);
fp_zero_multi(&p, &q, &dmp1, &dmq1, &iqmp, NULL);
if (res != 0) {
size = -4;
goto out;
}
} else {
fp_int d;
BN2mpz(&d, rsa->d);
res = fp_exptmod(&in, &d, &n, &out);
fp_zero(&d);
if (res != 0) {
size = -5;
goto out;
}
}
if (size > 0) {
size_t ssize;
ssize = fp_unsigned_bin_size(&out);
assert(size >= ssize);
fp_to_unsigned_bin(&out, to);
size = ssize;
}
out:
fp_zero_multi(&e, &n, &in, &out, NULL);
return size;
}
