int rsa_SETKEYS(RSA_CTX *ctx,unsigned char *N,unsigned char *d,
unsigned char *e){
int t;
/* we store in big - endian */
t=bnInsertBigBytes(&ctx->n,(void*)N,0,/*strlen(N)*/ctx->bits/8);
if(t<0)
return BADTHINGS;
t=bnInsertBigBytes(&ctx->d,(void*)d,0,/*strlen(d)*/ctx->bits/8);
if(t<0)
return BADTHINGS;
t=bnInsertBigBytes(&ctx->e,(void*)e,0,/*strlen(e)*/ctx->bits/8);
if(t<0)
return BADTHINGS;
bnNorm(&ctx->e);
return OK;
}
int
genRsaKey(struct PubKey *pub, struct SecKey *sec,
unsigned bits, unsigned exp, FILE *file)
{
int modexps = 0;
struct BigNum t; /* Temporary */
int i;
struct Progress progress;
progress.f = file;
progress.column = 0;
progress.wrap = 78;
if (bnSetQ(&pub->e, exp))
return -1;
/* Find p - choose a starting place */
if (genRandBn(&sec->p, bits/2, 0xC0, 1) < 0)
return -1;
/* And search for a prime */
i = primeGen(&sec->p, randRange, file ? genProgress : 0, &progress,
exp, 0);
if (i < 0)
goto error;
modexps = i;
assert(bnModQ(&sec->p, exp) != 1);
bndPut("p = ", &sec->p);
do {
/* Visual separator between the two progress indicators */
if (file)
genProgress(&progress, ' ');
if (genRandBn(&sec->q, (bits+1)/2, 0xC0, 1) < 0)
goto error;
if (bnCopy(&pub->n, &sec->q) < 0)
goto error;
if (bnSub(&pub->n, &sec->p) < 0)
goto error;
/* Note that bnSub(a,b) returns abs(a-b) */
} while (bnBits(&pub->n) < bits/2-5);
if (file)
fflush(file); /* Ensure the separators are visible */
i = primeGen(&sec->q, randRange, file ? genProgress : 0, &progress,
exp, 0);
if (i < 0)
goto error;
modexps += i;
assert(bnModQ(&sec->p, exp) != 1);
bndPut("q = ", &sec->q);
/* Wash the random number pool. */
randFlush();
/* Ensure that q is larger */
if (bnCmp(&sec->p, &sec->q) > 0)
bnSwap(&sec->p, &sec->q);
bndPut("p = ", &sec->p);
bndPut("q = ", &sec->q);
/*
* Now we dive into a large amount of fiddling to compute d,
* the decryption exponent, from the encryption exponent.
* We require that e*d == 1 (mod p-1) and e*d == 1 (mod q-1).
* This can alomost be done via the Chinese Remainder Algorithm,
* but it doesn't quite apply, because p-1 and q-1 are not
* realitvely prime. Our task is to massage these into
* two numbers a and b such that a*b = lcm(p-1,q-1) and
* gcd(a,b) = 1. The technique is not well documented,
* so I'll describe it here.
* First, let d = gcd(p-1,q-1), then let a' = (p-1)/d and
* b' = (q-1)/d. By the definition of the gcd, gcd(a',b') at
* this point is 1, but a'*b' is a factor of d shy of the desired
* value. We have to produce a = a' * d1 and b = b' * d2 such
* d1*d2 = d and gcd(a,b) is 1. This will be the case iff
* gcd(a,d2) = gcd(b,d1) = 1. Since GCD is associative and
* (gcd(x,y,z) = gcd(x,gcd(y,z)) = gcd(gcd(x,y),z), etc.),
* gcd(a',b') = 1 implies that gcd(a',b',d) = 1 which implies
* that gcd(a',gcd(b',d)) = gcd(gcd(a',d),b') = 1. So you can
* extract gcd(b',d) from d and make it part of d2, and the
* same for d1. And iterate? A pessimal example is x = 2*6^k
* and y = 3*6^k. gcd(x,y) = 6^k and we have to divvy it up
* somehow so that all the factors of 2 go to x and all the
* factors of 3 go to y, ending up with a = 2*2^k and b = 3*3^k.
*
* Aah, f**k it. It's simpler to do one big inverse for now.
* Later I'll figure out how to get this to work properly.
*/
/* Decrement q temporarily */
(void)bnSubQ(&sec->q, 1);
/* And u = p-1, to be divided by gcd(p-1,q-1) */
if (bnCopy(&sec->u, &sec->p) < 0)
goto error;
(void)bnSubQ(&sec->u, 1);
bndPut("p-1 = ", &sec->u);
bndPut("q-1 = ", &sec->q);
/* Use t to store gcd(p-1,q-1) */
bnBegin(&t);
if (bnGcd(&t, &sec->q, &sec->u) < 0) {
bnEnd(&t);
goto error;
}
bndPut("t = gcd(p-1,q-1) = ", &t);
/* Let d = (p-1) / gcd(p-1,q-1) (n is scratch for the remainder) */
i = bnDivMod(&sec->d, &pub->n, &sec->u, &t);
bndPut("(p-1)/t = ", &sec->d);
bndPut("(p-1)%t = ", &pub->n);
bnEnd(&t);
if (i < 0)
goto error;
assert(bnBits(&pub->n) == 0);
/* Now we have q-1 and d = (p-1) / gcd(p-1,q-1) */
/* Find the product, n = lcm(p-1,q-1) = c * d */
if (bnMul(&pub->n, &sec->q, &sec->d) < 0)
goto error;
bndPut("(p-1)*(q-1)/t = ", &pub->n);
/* Find the inverse of the exponent mod n */
i = bnInv(&sec->d, &pub->e, &pub->n);
bndPut("e = ", &pub->e);
bndPut("d = ", &sec->d);
if (i < 0)
goto error;
assert(!i); /* We should NOT get an error here */
/*
* Now we have the comparatively simple task of computing
* u = p^-1 mod q.
*/
#if BNDEBUG
bnMul(&sec->u, &sec->d, &pub->e);
bndPut("d * e = ", &sec->u);
bnMod(&pub->n, &sec->u, &sec->q);
bndPut("d * e = ", &sec->u);
bndPut("q-1 = ", &sec->q);
bndPut("d * e % (q-1)= ", &pub->n);
bnNorm(&pub->n);
bnSubQ(&sec->p, 1);
bndPut("d * e = ", &sec->u);
bnMod(&sec->u, &sec->u, &sec->p);
bndPut("p-1 = ", &sec->p);
bndPut("d * e % (p-1)= ", &sec->u);
bnNorm(&sec->u);
bnAddQ(&sec->p, 1);
#endif
/* But it *would* be nice to have q back first. */
(void)bnAddQ(&sec->q, 1);
bndPut("p = ", &sec->p);
bndPut("q = ", &sec->q);
/* Now compute u = p^-1 mod q */
i = bnInv(&sec->u, &sec->p, &sec->q);
if (i < 0)
goto error;
bndPut("u = p^-1 % q = ", &sec->u);
assert(!i); /* p and q had better be relatively prime! */
#if BNDEBUG
bnMul(&pub->n, &sec->u, &sec->p);
bndPut("u * p = ", &pub->n);
bnMod(&pub->n, &pub->n, &sec->q);
bndPut("u * p % q = ", &pub->n);
bnNorm(&pub->n);
#endif
/* And finally, n = p * q */
if (bnMul(&pub->n, &sec->p, &sec->q) < 0)
goto error;
bndPut("n = p * q = ", &pub->n);
/* And that's it... success! */
if (file)
putc('\n', file); /* Signal done */
return modexps;
error:
if (file)
fputs("?\n", file); /* Signal error */
return -1;
}