int mpi_cmp(MPI u, MPI v) { mpi_size_t usize, vsize; int cmp; mpi_normalize(u); mpi_normalize(v); usize = u->nlimbs; vsize = v->nlimbs; if (!u->sign && v->sign) return 1; if (u->sign && !v->sign) return -1; if (usize != vsize && !u->sign && !v->sign) return usize - vsize; if (usize != vsize && u->sign && v->sign) return vsize + usize; if (!usize) return 0; cmp = mpihelp_cmp(u->d, v->d, usize); if (!cmp) return 0; if ((cmp < 0 ? 1 : 0) == (u->sign ? 1 : 0)) return 1; return -1; }
/* This function returns a new context for Barrett based operations on the modulus M. This context needs to be released using _gcry_mpi_barrett_free. If COPY is true M will be transferred to the context and the user may change M. If COPY is false, M may not be changed until gcry_mpi_barrett_free has been called. */ mpi_barrett_t _gcry_mpi_barrett_init (gcry_mpi_t m, int copy) { mpi_barrett_t ctx; gcry_mpi_t tmp; mpi_normalize (m); ctx = xcalloc (1, sizeof *ctx); if (copy) { ctx->m = mpi_copy (m); ctx->m_copied = 1; } else ctx->m = m; ctx->k = mpi_get_nlimbs (m); tmp = mpi_alloc (ctx->k + 1); /* Barrett precalculation: y = floor(b^(2k) / m). */ mpi_set_ui (tmp, 1); mpi_lshift_limbs (tmp, 2 * ctx->k); mpi_fdiv_q (tmp, tmp, m); ctx->y = tmp; ctx->r1 = mpi_alloc ( 2 * ctx->k + 1 ); ctx->r2 = mpi_alloc ( 2 * ctx->k + 1 ); return ctx; }
/* R = X mod M Using Barrett reduction. Before using this function _gcry_mpi_barrett_init must have been called to do the precalculations. CTX is the context created by this precalculation and also conveys M. If the Barret reduction could no be done a straightforward reduction method is used. We assume that these conditions are met: Input: x =(x_2k-1 ...x_0)_b m =(m_k-1 ....m_0)_b with m_k-1 != 0 Output: r = x mod m */ void _gcry_mpi_mod_barrett (gcry_mpi_t r, gcry_mpi_t x, mpi_barrett_t ctx) { gcry_mpi_t m = ctx->m; int k = ctx->k; gcry_mpi_t y = ctx->y; gcry_mpi_t r1 = ctx->r1; gcry_mpi_t r2 = ctx->r2; int sign; mpi_normalize (x); if (mpi_get_nlimbs (x) > 2*k ) { mpi_mod (r, x, m); return; } sign = x->sign; x->sign = 0; /* 1. q1 = floor( x / b^k-1) * q2 = q1 * y * q3 = floor( q2 / b^k+1 ) * Actually, we don't need qx, we can work direct on r2 */ mpi_set ( r2, x ); mpi_rshift_limbs ( r2, k-1 ); mpi_mul ( r2, r2, y ); mpi_rshift_limbs ( r2, k+1 ); /* 2. r1 = x mod b^k+1 * r2 = q3 * m mod b^k+1 * r = r1 - r2 * 3. if r < 0 then r = r + b^k+1 */ mpi_set ( r1, x ); if ( r1->nlimbs > k+1 ) /* Quick modulo operation. */ r1->nlimbs = k+1; mpi_mul ( r2, r2, m ); if ( r2->nlimbs > k+1 ) /* Quick modulo operation. */ r2->nlimbs = k+1; mpi_sub ( r, r1, r2 ); if ( mpi_has_sign ( r ) ) { if (!ctx->r3) { ctx->r3 = mpi_alloc ( k + 2 ); mpi_set_ui (ctx->r3, 1); mpi_lshift_limbs (ctx->r3, k + 1 ); } mpi_add ( r, r, ctx->r3 ); } /* 4. while r >= m do r = r - m */ while ( mpi_cmp( r, m ) >= 0 ) mpi_sub ( r, r, m ); x->sign = sign; }
static void decrypt(MPI output, MPI a, MPI b, ELG_secret_key *skey ) { MPI t1 = mpi_alloc_secure( mpi_get_nlimbs( skey->p ) ); mpi_normalize (a); mpi_normalize (b); /* output = b/(a^x) mod p */ mpi_powm( t1, a, skey->x, skey->p ); mpi_invm( t1, t1, skey->p ); mpi_mulm( output, b, t1, skey->p ); #if 0 if( DBG_CIPHER ) { log_mpidump("elg decrypted x= ", skey->x); log_mpidump("elg decrypted p= ", skey->p); log_mpidump("elg decrypted a= ", a); log_mpidump("elg decrypted b= ", b); log_mpidump("elg decrypted M= ", output); } #endif mpi_free(t1); }
/**************** * Barrett precalculation: y = floor(b^(2k) / m) */ static gcry_mpi_t init_barrett( gcry_mpi_t m, int *k, gcry_mpi_t *r1, gcry_mpi_t *r2 ) { gcry_mpi_t tmp; mpi_normalize( m ); *k = mpi_get_nlimbs( m ); tmp = mpi_alloc( *k + 1 ); mpi_set_ui( tmp, 1 ); mpi_lshift_limbs( tmp, 2 * *k ); mpi_fdiv_q( tmp, tmp, m ); *r1 = mpi_alloc( 2* *k + 1 ); *r2 = mpi_alloc( 2* *k + 1 ); return tmp; }
/**************** * Barrett reduction: We assume that these conditions are met: * Given x =(x_2k-1 ...x_0)_b * m =(m_k-1 ....m_0)_b with m_k-1 != 0 * Output r = x mod m * Before using this function init_barret must be used to calucalte y and k. * Returns: false = no error * true = can't perform barret reduction */ static int calc_barrett( gcry_mpi_t r, gcry_mpi_t x, gcry_mpi_t m, gcry_mpi_t y, int k, gcry_mpi_t r1, gcry_mpi_t r2 ) { int xx = k > 3 ? k-3:0; mpi_normalize( x ); if( mpi_get_nlimbs(x) > 2*k ) return 1; /* can't do it */ /* 1. q1 = floor( x / b^k-1) * q2 = q1 * y * q3 = floor( q2 / b^k+1 ) * Actually, we don't need qx, we can work direct on r2 */ mpi_set( r2, x ); mpi_rshift_limbs( r2, k-1 ); mpi_mul( r2, r2, y ); mpi_rshift_limbs( r2, k+1 ); /* 2. r1 = x mod b^k+1 * r2 = q3 * m mod b^k+1 * r = r1 - r2 * 3. if r < 0 then r = r + b^k+1 */ mpi_set( r1, x ); if( r1->nlimbs > k+1 ) /* quick modulo operation */ r1->nlimbs = k+1; mpi_mul( r2, r2, m ); if( r2->nlimbs > k+1 ) /* quick modulo operation */ r2->nlimbs = k+1; mpi_sub( r, r1, r2 ); if( mpi_has_sign (r) ) { gcry_mpi_t tmp; tmp = mpi_alloc( k + 2 ); mpi_set_ui( tmp, 1 ); mpi_lshift_limbs( tmp, k+1 ); mpi_add( r, r, tmp ); mpi_free(tmp); } /* 4. while r >= m do r = r - m */ while( mpi_cmp( r, m ) >= 0 ) mpi_sub( r, r, m ); return 0; }
/**************** * Return the number of bits in A. */ unsigned mpi_get_nbits( MPI a ) { unsigned n; mpi_normalize( a ); if( a->nlimbs ) { mpi_limb_t alimb = a->d[a->nlimbs-1]; if( alimb ) count_leading_zeros( n, alimb ); else n = BITS_PER_MPI_LIMB; n = BITS_PER_MPI_LIMB - n + (a->nlimbs-1) * BITS_PER_MPI_LIMB; } else n = 0; return n; }
int mpi_cmp_ui(MPI u, unsigned long v) { mpi_limb_t limb = v; mpi_normalize(u); if (!u->nlimbs && !limb) return 0; if (u->sign) return -1; if (u->nlimbs > 1) return 1; if (u->d[0] == limb) return 0; else if (u->d[0] > limb) return 1; else return -1; }
/* Convert the external representation of an integer stored in BUFFER with a length of BUFLEN into a newly create MPI returned in RET_MPI. If NBYTES is not NULL, it will receive the number of bytes actually scanned after a successful operation. */ gcry_error_t gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, const void *buffer_arg, size_t buflen, size_t *nscanned) { const unsigned char *buffer = (const unsigned char*)buffer_arg; struct gcry_mpi *a = NULL; unsigned int len; int secure = (buffer && gcry_is_secure (buffer)); if (format == GCRYMPI_FMT_SSH) len = 0; else len = buflen; if (format == GCRYMPI_FMT_STD) { const unsigned char *s = buffer; a = secure? mpi_alloc_secure ((len+BYTES_PER_MPI_LIMB-1) /BYTES_PER_MPI_LIMB) : mpi_alloc ((len+BYTES_PER_MPI_LIMB-1)/BYTES_PER_MPI_LIMB); if (len) { a->sign = !!(*s & 0x80); if (a->sign) { /* FIXME: we have to convert from 2compl to magnitude format */ mpi_free (a); return gcry_error (GPG_ERR_INTERNAL); } else _gcry_mpi_set_buffer (a, s, len, 0); } if (ret_mpi) { mpi_normalize ( a ); *ret_mpi = a; } else mpi_free(a); return 0; } else if (format == GCRYMPI_FMT_USG) { a = secure? mpi_alloc_secure ((len+BYTES_PER_MPI_LIMB-1) /BYTES_PER_MPI_LIMB) : mpi_alloc ((len+BYTES_PER_MPI_LIMB-1)/BYTES_PER_MPI_LIMB); if (len) _gcry_mpi_set_buffer (a, buffer, len, 0); if (ret_mpi) { mpi_normalize ( a ); *ret_mpi = a; } else mpi_free(a); return 0; } else if (format == GCRYMPI_FMT_PGP) { a = mpi_read_from_buffer (buffer, &len, secure); if (nscanned) *nscanned = len; if (ret_mpi && a) { mpi_normalize (a); *ret_mpi = a; } else if (a) { mpi_free(a); a = NULL; } return a? 0 : gcry_error (GPG_ERR_INV_OBJ); } else if (format == GCRYMPI_FMT_SSH) { const unsigned char *s = buffer; size_t n; /* This test is not strictly necessary and an assert (!len) would be sufficient. We keep this test in case we later allow the BUFLEN argument to act as a sanitiy check. Same below. */ if (len && len < 4) return gcry_error (GPG_ERR_TOO_SHORT); n = (s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]); s += 4; if (len) len -= 4; if (len && n > len) return gcry_error (GPG_ERR_TOO_LARGE); a = secure? mpi_alloc_secure ((n+BYTES_PER_MPI_LIMB-1) /BYTES_PER_MPI_LIMB) : mpi_alloc ((n+BYTES_PER_MPI_LIMB-1)/BYTES_PER_MPI_LIMB); if (n) { a->sign = !!(*s & 0x80); if (a->sign) { /* FIXME: we have to convert from 2compl to magnitude format */ mpi_free(a); return gcry_error (GPG_ERR_INTERNAL); } else _gcry_mpi_set_buffer( a, s, n, 0 ); } if (nscanned) *nscanned = n+4; if (ret_mpi) { mpi_normalize ( a ); *ret_mpi = a; } else mpi_free(a); return 0; } else if (format == GCRYMPI_FMT_HEX) { /* We can only handle C strings for now. */ if (buflen) return gcry_error (GPG_ERR_INV_ARG); a = secure? mpi_alloc_secure (0) : mpi_alloc(0); if (mpi_fromstr (a, (const char *)buffer)) { mpi_free (a); return gcry_error (GPG_ERR_INV_OBJ); } if (ret_mpi) { mpi_normalize ( a ); *ret_mpi = a; } else mpi_free(a); return 0; } else return gcry_error (GPG_ERR_INV_ARG); }