/*----------------------------------------------------------------------------*/
static zrtp_status_t zrtp_dh_init(void *s)
{
struct BigNum* p = NULL;
struct BigNum* p_1 = NULL;
uint8_t* p_data = NULL;
unsigned int p_data_length = 0;
zrtp_pk_scheme_t *self = (zrtp_pk_scheme_t *) s;
switch (self->base.id) {
case ZRTP_PKTYPE_DH2048:
p = &self->base.zrtp->P_2048;
p_1 = &self->base.zrtp->P_2048_1;
p_data = self->base.zrtp->P_2048_data;
p_data_length = sizeof(self->base.zrtp->P_2048_data);
break;
case ZRTP_PKTYPE_DH3072:
p = &self->base.zrtp->P_3072;
p_1 = &self->base.zrtp->P_3072_1;
p_data = self->base.zrtp->P_3072_data;
p_data_length = sizeof(self->base.zrtp->P_3072_data);
break;
default:
return zrtp_status_bad_param;
}
bnBegin(p);
bnInsertBigBytes(p, (const unsigned char *)p_data, 0, p_data_length);
bnBegin(p_1);
bnCopy(p_1, p);
bnSub(p_1, &self->base.zrtp->one);
return zrtp_status_ok;
}
/*
* This performs a modular exponentiation using the Chinese Remainder
* Algorithm when the modulus is known to have two relatively prime
* factors n = p * q, and u = p^-1 (mod q) has been precomputed.
*
* The chinese remainder algorithm lets a computation mod n be performed
* mod p and mod q, and the results combined. Since it takes
* (considerably) more than twice as long to perform modular exponentiation
* mod n as it does to perform it mod p and mod q, time is saved.
*
* If x is the desired result, let xp and xq be the values of x mod p
* and mod q, respectively. Obviously, x = xp + p * k for some k.
* Taking this mod q, xq == xp + p*k (mod q), so p*k == xq-xp (mod q)
* and k == p^-1 * (xq-xp) (mod q), so k = u * (xq-xp mod q) mod q.
* After that, x = xp + p * k.
*
* Another savings comes from reducing the exponent d modulo phi(p)
* and phi(q). Here, we assume that p and q are prime, so phi(p) = p-1
* and phi(q) = q-1.
*/
static int
bnExpModCRA(BigNum *x, BigNum const *d,
BigNum const *p, BigNum const *q, BigNum const *u)
{
BigNum xp, xq, k;
int i;
PGPMemoryMgrRef mgr = x->mgr;
bndPrintf("Performing Chinese Remainder Algorithm\n");
bndPut("x = ", x);
bndPut("p = ", p);
bndPut("q = ", q);
bndPut("d = ", d);
bndPut("u = ", u);
bnBegin(&xp, mgr, TRUE);
bnBegin(&xq, mgr, TRUE);
bnBegin(&k, mgr, TRUE);
/* Compute xp = (x mod p) ^ (d mod p-1) mod p */
if (bnCopy(&xp, p) < 0) /* First, use xp to hold p-1 */
goto fail;
(void)bnSubQ(&xp, 1); /* p > 1, so subtracting is safe. */
if (bnMod(&k, d, &xp) < 0) /* k = d mod (p-1) */
goto fail;
bndPut("d mod p-1 = ", &k);
if (bnMod(&xp, x, p) < 0) /* Now xp = (x mod p) */
goto fail;
bndPut("x mod p = ", &xp);
if (bnExpMod(&xp, &xp, &k, p) < 0) /* xp = (x mod p)^k mod p */
goto fail;
bndPut("xp = x^d mod p = ", &xp);
/* Compute xq = (x mod q) ^ (d mod q-1) mod q */
if (bnCopy(&xq, q) < 0) /* First, use xq to hold q-1 */
goto fail;
(void)bnSubQ(&xq, 1); /* q > 1, so subtracting is safe. */
if (bnMod(&k, d, &xq) < 0) /* k = d mod (q-1) */
goto fail;
bndPut("d mod q-1 = ", &k);
if (bnMod(&xq, x, q) < 0) /* Now xq = (x mod q) */
goto fail;
bndPut("x mod q = ", &xq);
if (bnExpMod(&xq, &xq, &k, q) < 0) /* xq = (x mod q)^k mod q */
goto fail;
bndPut("xq = x^d mod q = ", &xq);
/* xp < p and PGP has p < q, so this is a no-op, but just in case */
if (bnMod(&k, &xp, q) < 0)
goto fail;
bndPut("xp mod q = ", &k);
i = bnSub(&xq, &k);
bndPut("xq - xp = ", &xq);
bndPrintf("With sign %d\n", i);
if (i < 0)
goto fail;
if (i) {
/*
* Borrow out - xq-xp is negative, so bnSub returned
* xp-xq instead, the negative of the true answer.
* Add q back (which is subtracting from the negative)
* so the sign flips again.
*/
i = bnSub(&xq, q);
if (i < 0)
goto fail;
bndPut("xq - xp mod q = ", &xq);
bndPrintf("With sign %d\n", i); /* Must be 1 */
}
/* Compute k = xq * u mod q */
if (bnMul(&k, u, &xq) < 0)
goto fail;
bndPut("(xq-xp) * u = ", &k);
if (bnMod(&k, &k, q) < 0)
goto fail;
bndPut("k = (xq-xp)*u % q = ", &k);
/* Now x = k * p + xp is the final answer */
if (bnMul(x, &k, p) < 0)
goto fail;
bndPut("k * p = ", x);
if (bnAdd(x, &xp) < 0)
goto fail;
bndPut("k*p + xp = ", x);
#if BNDEBUG /* @@@ DEBUG - do it the slow way for comparison */
if (bnMul(&xq, p, q) < 0)
goto fail;
bndPut("n = p*q = ", &xq);
if (bnExpMod(&xp, x, d, &xq) < 0)
goto fail;
bndPut("x^d mod n = ", &xp);
if (bnCmp(x, &xp) != 0) {
bndPrintf("Nasty!!!\n");
goto fail;
}
bnSetQ(&k, 17);
bnExpMod(&xp, &xp, &k, &xq);
bndPut("x^17 mod n = ", &xp);
#endif
bnEnd(&xp);
bnEnd(&xq);
bnEnd(&k);
return 0;
fail:
bnEnd(&xp);
bnEnd(&xq);
bnEnd(&k);
return kPGPError_OutOfMemory;
}
/*
* Modifies the given bnq to return a prime slightly larger, and then
* modifies the given bnp to be a prime which is == 1 (mod bnq).
* This is done by decreasing bnp until it is == 1 (mod 2*bnq), and
* then searching forward in steps of 2*bnq.
* Returns >=0 on success or -1 on failure (out of memory). On
* success, the return value is the number of modular exponentiations
* performed (excluding the final confirmation).
* This never gives up searching.
*
* int (*f)(void *arg, int c), void *arg
* The function f argument, if non-NULL, is called with progress indicator
* characters for printing. A dot (.) is written every time a primality test
* is failed, a star (*) every time one is passed, and a slash (/) in the
* case that the sieve was emptied without finding a prime and is being
* refilled. f is also passed the void *arg argument for private
* context storage. If f returns < 0, the test aborts and returns
* that value immediately.
*
* Apologies to structured programmers for all the GOTOs.
*/
int
dsaPrimeGen(BigNum *bnq, BigNum *bnp,
int (*f)(void *arg, int c), void *arg)
{
int retval;
unsigned p, prev;
BigNum a, e;
int modexps = 0;
#ifdef MSDOS
unsigned char *sieve;
#else
unsigned char sieve[SIEVE];
#endif
#ifdef MSDOS
sieve = bniMemAlloc(SIEVE);
if (!sieve)
return -1;
#endif
bnBegin(&a);
bnBegin(&e);
/* Phase 1: Search forwards from bnq for a suitable prime. */
/* First, make sure that bnq is odd. */
(void)bnAddQ(bnq, ~bnLSWord(bnq) & 1);
for (;;) {
if (sieveBuild(sieve, SIEVE, bnq, 2, 1) < 0)
goto failed;
p = prev = 0;
if (sieve[0] & 1 || (p = sieveSearch(sieve, SIEVE, p)) != 0) {
do {
/*
* Adjust bn to have the right value,
* incrementing in steps of < 65536.
* 32767 = 65535/2.
*/
pgpAssert(p >= prev);
prev = p-prev; /* Delta - add 2*prev to bn */
#if SIEVE*8*2 >= 65536
while (prev > 32767) {
if (bnAddQ(bnq, 2*32767) < 0)
goto failed;
prev -= 32767;
}
#endif
if (bnAddQ(bnq, 2*prev) < 0)
goto failed;
prev = p;
retval = primeTest(bnq, &e, &a, f, arg);
if (retval <= 0)
goto phase2; /* Success! */
modexps += retval;
if (f && (retval = f(arg, '.')) < 0)
goto done;
/* And try again */
p = sieveSearch(sieve, SIEVE, p);
} while (p);
}
/* Ran out of sieve space - increase bn and keep trying. */
#if SIEVE*8*2 >= 65536
p = ((SIEVE-1)*8+7) - prev; /* Number of steps (of 2) */
while (p >= 32737) {
if (bnAddQ(bnq, 2*32767) < 0)
goto failed;
p -= 32767;
}
if (bnAddQ(bnq, 2*(p+1)) < 0)
goto failed;
#else
if (bnAddQ(bnq, SIEVE*8*2 - prev) < 0)
goto failed;
#endif
if (f && (retval = f(arg, '/')) < 0)
goto done;
} /* for (;;) */
/*
* Phase 2: find a suitable prime bnp == 1 (mod bnq).
*/
/*
* Since bnp will be, and bnq is, odd, bnp-1 must be a multiple
* of 2*bnq. So start by subtracting the excess.
*/
phase2:
/* Double bnq until end of bnp search. */
if (bnAdd(bnq, bnq) < 0)
goto failed;
bnMod(&a, bnp, bnq);
if (bnBits(&a)) { /* Will always be true, but... */
(void)bnSubQ(&a, 1);
if (bnSub(bnp, &a)) /* Also error on underflow */
goto failed;
}
/* Okay, now we're ready. */
for (;;) {
if (sieveBuildBig(sieve, SIEVE, bnp, bnq, 0) < 0)
goto failed;
if (f && (retval = f(arg, '/')) < 0)
goto done;
p = prev = 0;
if (sieve[0] & 1 || (p = sieveSearch(sieve, SIEVE, p)) != 0) {
do {
/*
* Adjust bn to have the right value,
* adding (p-prev) * 2*bnq.
*/
pgpAssert(p >= prev);
/* Compute delta into a */
if (bnMulQ(&a, bnq, p-prev) < 0)
goto failed;
if (bnAdd(bnp, &a) < 0)
goto failed;
prev = p;
retval = primeTest(bnp, &e, &a, f, arg);
if (retval <= 0)
goto done; /* Success! */
modexps += retval;
if (f && (retval = f(arg, '.')) < 0)
goto done;
/* And try again */
p = sieveSearch(sieve, SIEVE, p);
} while (p);
}
/* Ran out of sieve space - increase bn and keep trying. */
#if SIEVE*8 == 65536
if (prev) {
p = (unsigned)(SIEVE*8ul - prev);
} else {
/* Corner case that will never actually happen */
if (bnAdd(bnp, bnq) < 0)
goto failed;
p = 65535;
}
#else
p = SIEVE*8 - prev;
#endif
/* Add p * bnq to bnp */
if (bnMulQ(&a, bnq, p) < 0)
goto failed;
if (bnAdd(bnp, &a) < 0)
goto failed;
} /* for (;;) */
failed:
retval = -1;
done:
/* Shift bnq back down by the extra bit again. */
bnRShift(bnq, 1); /* Harmless even if bnq is random */
bnEnd(&e);
bnEnd(&a);
#ifdef MSDOS
bniMemFree(sieve, SIEVE);
#else
bniMemWipe(sieve, sizeof(sieve));
#endif
return retval < 0 ? retval : modexps + 2*CONFIRMTESTS;
}
/*
* lhs-rhs. dest and src may be the same, but bnSetQ(dest, 0) is faster.
* if dest < src, returns error and dest is undefined.
*/
PGPError
PGPBigNumSubtract(
PGPBigNumRef lhs,
PGPBigNumRef rhs,
PGPBigNumRef dest,
PGPBoolean * underflowPtr )
{
PGPError err = kPGPError_NoErr;
int bnError;
PGPBoolean underflow = FALSE;
if ( IsntNull( underflowPtr ) )
*underflowPtr = FALSE;
pgpValidateBigNum( lhs );
pgpValidateBigNum( rhs );
pgpValidateBigNum( dest );
if ( lhs == dest )
{
bnError = bnSub( &dest->bn, &rhs->bn );
underflow = (bnError == 1);
bnError = 0;
}
else if ( rhs == dest )
{
BigNum temp;
PGPBoolean secure;
secure = lhs->bn.isSecure || rhs->bn.isSecure ||
dest->bn.isSecure;
bnBegin( &temp, dest->bn.mgr, secure );
bnError = bnCopy( &temp, &lhs->bn );
if ( bnError == 0 )
{
bnError = bnSub( &temp, &rhs->bn );
underflow = (bnError == 1);
bnError = 0;
bnError = bnCopy( &dest->bn, &temp );
}
bnEnd( &temp );
}
else
{
bnError = bnCopy( &dest->bn, &lhs->bn );
if ( bnError == 0 )
{
bnError = bnSub( &dest->bn, &rhs->bn );
underflow = (bnError == 1);
bnError = 0;
}
}
if ( IsntNull( underflowPtr ) )
*underflowPtr = underflow;
if ( bnError == -1 )
err = kPGPError_OutOfMemory;
return( err );
}
int
genRsaKey(struct PubKey *pub, struct SecKey *sec,
unsigned bits, unsigned exp, FILE *file)
{
int modexps = 0;
struct BigNum t; /* Temporary */
int i;
struct Progress progress;
progress.f = file;
progress.column = 0;
progress.wrap = 78;
if (bnSetQ(&pub->e, exp))
return -1;
/* Find p - choose a starting place */
if (genRandBn(&sec->p, bits/2, 0xC0, 1) < 0)
return -1;
/* And search for a prime */
i = primeGen(&sec->p, randRange, file ? genProgress : 0, &progress,
exp, 0);
if (i < 0)
goto error;
modexps = i;
assert(bnModQ(&sec->p, exp) != 1);
bndPut("p = ", &sec->p);
do {
/* Visual separator between the two progress indicators */
if (file)
genProgress(&progress, ' ');
if (genRandBn(&sec->q, (bits+1)/2, 0xC0, 1) < 0)
goto error;
if (bnCopy(&pub->n, &sec->q) < 0)
goto error;
if (bnSub(&pub->n, &sec->p) < 0)
goto error;
/* Note that bnSub(a,b) returns abs(a-b) */
} while (bnBits(&pub->n) < bits/2-5);
if (file)
fflush(file); /* Ensure the separators are visible */
i = primeGen(&sec->q, randRange, file ? genProgress : 0, &progress,
exp, 0);
if (i < 0)
goto error;
modexps += i;
assert(bnModQ(&sec->p, exp) != 1);
bndPut("q = ", &sec->q);
/* Wash the random number pool. */
randFlush();
/* Ensure that q is larger */
if (bnCmp(&sec->p, &sec->q) > 0)
bnSwap(&sec->p, &sec->q);
bndPut("p = ", &sec->p);
bndPut("q = ", &sec->q);
/*
* Now we dive into a large amount of fiddling to compute d,
* the decryption exponent, from the encryption exponent.
* We require that e*d == 1 (mod p-1) and e*d == 1 (mod q-1).
* This can alomost be done via the Chinese Remainder Algorithm,
* but it doesn't quite apply, because p-1 and q-1 are not
* realitvely prime. Our task is to massage these into
* two numbers a and b such that a*b = lcm(p-1,q-1) and
* gcd(a,b) = 1. The technique is not well documented,
* so I'll describe it here.
* First, let d = gcd(p-1,q-1), then let a' = (p-1)/d and
* b' = (q-1)/d. By the definition of the gcd, gcd(a',b') at
* this point is 1, but a'*b' is a factor of d shy of the desired
* value. We have to produce a = a' * d1 and b = b' * d2 such
* d1*d2 = d and gcd(a,b) is 1. This will be the case iff
* gcd(a,d2) = gcd(b,d1) = 1. Since GCD is associative and
* (gcd(x,y,z) = gcd(x,gcd(y,z)) = gcd(gcd(x,y),z), etc.),
* gcd(a',b') = 1 implies that gcd(a',b',d) = 1 which implies
* that gcd(a',gcd(b',d)) = gcd(gcd(a',d),b') = 1. So you can
* extract gcd(b',d) from d and make it part of d2, and the
* same for d1. And iterate? A pessimal example is x = 2*6^k
* and y = 3*6^k. gcd(x,y) = 6^k and we have to divvy it up
* somehow so that all the factors of 2 go to x and all the
* factors of 3 go to y, ending up with a = 2*2^k and b = 3*3^k.
*
* Aah, f**k it. It's simpler to do one big inverse for now.
* Later I'll figure out how to get this to work properly.
*/
/* Decrement q temporarily */
(void)bnSubQ(&sec->q, 1);
/* And u = p-1, to be divided by gcd(p-1,q-1) */
if (bnCopy(&sec->u, &sec->p) < 0)
goto error;
(void)bnSubQ(&sec->u, 1);
bndPut("p-1 = ", &sec->u);
bndPut("q-1 = ", &sec->q);
/* Use t to store gcd(p-1,q-1) */
bnBegin(&t);
if (bnGcd(&t, &sec->q, &sec->u) < 0) {
bnEnd(&t);
goto error;
}
bndPut("t = gcd(p-1,q-1) = ", &t);
/* Let d = (p-1) / gcd(p-1,q-1) (n is scratch for the remainder) */
i = bnDivMod(&sec->d, &pub->n, &sec->u, &t);
bndPut("(p-1)/t = ", &sec->d);
bndPut("(p-1)%t = ", &pub->n);
bnEnd(&t);
if (i < 0)
goto error;
assert(bnBits(&pub->n) == 0);
/* Now we have q-1 and d = (p-1) / gcd(p-1,q-1) */
/* Find the product, n = lcm(p-1,q-1) = c * d */
if (bnMul(&pub->n, &sec->q, &sec->d) < 0)
goto error;
bndPut("(p-1)*(q-1)/t = ", &pub->n);
/* Find the inverse of the exponent mod n */
i = bnInv(&sec->d, &pub->e, &pub->n);
bndPut("e = ", &pub->e);
bndPut("d = ", &sec->d);
if (i < 0)
goto error;
assert(!i); /* We should NOT get an error here */
/*
* Now we have the comparatively simple task of computing
* u = p^-1 mod q.
*/
#if BNDEBUG
bnMul(&sec->u, &sec->d, &pub->e);
bndPut("d * e = ", &sec->u);
bnMod(&pub->n, &sec->u, &sec->q);
bndPut("d * e = ", &sec->u);
bndPut("q-1 = ", &sec->q);
bndPut("d * e % (q-1)= ", &pub->n);
bnNorm(&pub->n);
bnSubQ(&sec->p, 1);
bndPut("d * e = ", &sec->u);
bnMod(&sec->u, &sec->u, &sec->p);
bndPut("p-1 = ", &sec->p);
bndPut("d * e % (p-1)= ", &sec->u);
bnNorm(&sec->u);
bnAddQ(&sec->p, 1);
#endif
/* But it *would* be nice to have q back first. */
(void)bnAddQ(&sec->q, 1);
bndPut("p = ", &sec->p);
bndPut("q = ", &sec->q);
/* Now compute u = p^-1 mod q */
i = bnInv(&sec->u, &sec->p, &sec->q);
if (i < 0)
goto error;
bndPut("u = p^-1 % q = ", &sec->u);
assert(!i); /* p and q had better be relatively prime! */
#if BNDEBUG
bnMul(&pub->n, &sec->u, &sec->p);
bndPut("u * p = ", &pub->n);
bnMod(&pub->n, &pub->n, &sec->q);
bndPut("u * p % q = ", &pub->n);
bnNorm(&pub->n);
#endif
/* And finally, n = p * q */
if (bnMul(&pub->n, &sec->p, &sec->q) < 0)
goto error;
bndPut("n = p * q = ", &pub->n);
/* And that's it... success! */
if (file)
putc('\n', file); /* Signal done */
return modexps;
error:
if (file)
fputs("?\n", file); /* Signal error */
return -1;
}