static struct ec_curve *ec_p256(void) { static struct ec_curve curve = { 0 }; static bool initialised = false; if (!initialised) { mp_int *p = MP_LITERAL(0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff); mp_int *a = MP_LITERAL(0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc); mp_int *b = MP_LITERAL(0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b); mp_int *G_x = MP_LITERAL(0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296); mp_int *G_y = MP_LITERAL(0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5); mp_int *G_order = MP_LITERAL(0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551); mp_int *nonsquare_mod_p = mp_from_integer(3); initialise_wcurve(&curve, p, a, b, nonsquare_mod_p, G_x, G_y, G_order); mp_free(p); mp_free(a); mp_free(b); mp_free(G_x); mp_free(G_y); mp_free(G_order); mp_free(nonsquare_mod_p); curve.textname = curve.name = "nistp256"; /* Now initialised, no need to do it again */ initialised = true; } return &curve; }
static struct ec_curve *ec_ed25519(void) { static struct ec_curve curve = { 0 }; static bool initialised = false; if (!initialised) { mp_int *p = MP_LITERAL(0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed); mp_int *d = MP_LITERAL(0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3); mp_int *a = MP_LITERAL(0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec); /* == p-1 */ mp_int *G_x = MP_LITERAL(0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a); mp_int *G_y = MP_LITERAL(0x6666666666666666666666666666666666666666666666666666666666666658); mp_int *G_order = MP_LITERAL(0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed); mp_int *nonsquare_mod_p = mp_from_integer(2); initialise_ecurve(&curve, p, d, a, nonsquare_mod_p, G_x, G_y, G_order); mp_free(p); mp_free(d); mp_free(a); mp_free(G_x); mp_free(G_y); mp_free(G_order); mp_free(nonsquare_mod_p); /* This curve doesn't need a name, because it's never used in * any format that embeds the curve name */ curve.name = NULL; curve.textname = "Ed25519"; /* Now initialised, no need to do it again */ initialised = true; } return &curve; }
static struct ec_curve *ec_p384(void) { static struct ec_curve curve = { 0 }; static bool initialised = false; if (!initialised) { mp_int *p = MP_LITERAL(0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff); mp_int *a = MP_LITERAL(0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc); mp_int *b = MP_LITERAL(0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef); mp_int *G_x = MP_LITERAL(0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7); mp_int *G_y = MP_LITERAL(0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f); mp_int *G_order = MP_LITERAL(0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973); mp_int *nonsquare_mod_p = mp_from_integer(19); initialise_wcurve(&curve, p, a, b, nonsquare_mod_p, G_x, G_y, G_order); mp_free(p); mp_free(a); mp_free(b); mp_free(G_x); mp_free(G_y); mp_free(G_order); mp_free(nonsquare_mod_p); curve.textname = curve.name = "nistp384"; /* Now initialised, no need to do it again */ initialised = true; } return &curve; }
static struct ec_curve *ec_p521(void) { static struct ec_curve curve = { 0 }; static bool initialised = false; if (!initialised) { mp_int *p = MP_LITERAL(0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff); mp_int *a = MP_LITERAL(0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc); mp_int *b = MP_LITERAL(0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00); mp_int *G_x = MP_LITERAL(0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66); mp_int *G_y = MP_LITERAL(0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650); mp_int *G_order = MP_LITERAL(0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409); mp_int *nonsquare_mod_p = mp_from_integer(3); initialise_wcurve(&curve, p, a, b, nonsquare_mod_p, G_x, G_y, G_order); mp_free(p); mp_free(a); mp_free(b); mp_free(G_x); mp_free(G_y); mp_free(G_order); mp_free(nonsquare_mod_p); curve.textname = curve.name = "nistp521"; /* Now initialised, no need to do it again */ initialised = true; } return &curve; }
int dsa_generate(struct dss_key *key, int bits, progfn_t pfn, void *pfnparam) { /* * Set up the phase limits for the progress report. We do this * by passing minus the phase number. * * For prime generation: our initial filter finds things * coprime to everything below 2^16. Computing the product of * (p-1)/p for all prime p below 2^16 gives about 20.33; so * among B-bit integers, one in every 20.33 will get through * the initial filter to be a candidate prime. * * Meanwhile, we are searching for primes in the region of 2^B; * since pi(x) ~ x/log(x), when x is in the region of 2^B, the * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about * 1/0.6931B. So the chance of any given candidate being prime * is 20.33/0.6931B, which is roughly 29.34 divided by B. * * So now we have this probability P, we're looking at an * exponential distribution with parameter P: we will manage in * one attempt with probability P, in two with probability * P(1-P), in three with probability P(1-P)^2, etc. The * probability that we have still not managed to find a prime * after N attempts is (1-P)^N. * * We therefore inform the progress indicator of the number B * (29.34/B), so that it knows how much to increment by each * time. We do this in 16-bit fixed point, so 29.34 becomes * 0x1D.57C4. */ pfn(pfnparam, PROGFN_PHASE_EXTENT, 1, 0x2800); pfn(pfnparam, PROGFN_EXP_PHASE, 1, -0x1D57C4 / 160); pfn(pfnparam, PROGFN_PHASE_EXTENT, 2, 0x40 * bits); pfn(pfnparam, PROGFN_EXP_PHASE, 2, -0x1D57C4 / bits); /* * In phase three we are finding an order-q element of the * multiplicative group of p, by finding an element whose order * is _divisible_ by q and raising it to the power of (p-1)/q. * _Most_ elements will have order divisible by q, since for a * start phi(p) of them will be primitive roots. So * realistically we don't need to set this much below 1 (64K). * Still, we'll set it to 1/2 (32K) to be on the safe side. */ pfn(pfnparam, PROGFN_PHASE_EXTENT, 3, 0x2000); pfn(pfnparam, PROGFN_EXP_PHASE, 3, -32768); pfn(pfnparam, PROGFN_READY, 0, 0); unsigned pfirst, qfirst; invent_firstbits(&pfirst, &qfirst, 0); /* * Generate q: a prime of length 160. */ mp_int *q = primegen(160, 2, 2, NULL, 1, pfn, pfnparam, qfirst); /* * Now generate p: a prime of length `bits', such that p-1 is * divisible by q. */ mp_int *p = primegen(bits-160, 2, 2, q, 2, pfn, pfnparam, pfirst); /* * Next we need g. Raise 2 to the power (p-1)/q modulo p, and * if that comes out to one then try 3, then 4 and so on. As * soon as we hit a non-unit (and non-zero!) one, that'll do * for g. */ mp_int *power = mp_div(p, q); /* this is floor(p/q) == (p-1)/q */ mp_int *h = mp_from_integer(1); int progress = 0; mp_int *g; while (1) { pfn(pfnparam, PROGFN_PROGRESS, 3, ++progress); g = mp_modpow(h, power, p); if (mp_hs_integer(g, 2)) break; /* got one */ mp_free(g); mp_add_integer_into(h, h, 1); } mp_free(h); mp_free(power); /* * Now we're nearly done. All we need now is our private key x, * which should be a number between 1 and q-1 exclusive, and * our public key y = g^x mod p. */ mp_int *two = mp_from_integer(2); mp_int *qm1 = mp_copy(q); mp_sub_integer_into(qm1, qm1, 1); mp_int *x = mp_random_in_range(two, qm1); mp_free(two); mp_free(qm1); key->sshk.vt = &ssh_dss; key->p = p; key->q = q; key->g = g; key->x = x; key->y = mp_modpow(key->g, key->x, key->p); return 1; }