git.distorted.org.uk Git - u/mdw/catacomb/blob - rsa-gen.c

   1 /* -*-c-*-
   2  *
   3  * $Id: rsa-gen.c,v 1.4 2000/10/08 12:11:22 mdw Exp $
   4  *
   5  * RSA parameter generation
   6  *
   7  * (c) 1999 Straylight/Edgeware
   8  */
   9
  10 /*----- Licensing notice --------------------------------------------------*
  11  *
  12  * This file is part of Catacomb.
  13  *
  14  * Catacomb is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU Library General Public License as
  16  * published by the Free Software Foundation; either version 2 of the
  17  * License, or (at your option) any later version.
  18  *
  19  * Catacomb is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU Library General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU Library General Public
  25  * License along with Catacomb; if not, write to the Free
  26  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  27  * MA 02111-1307, USA.
  28  */
  29
  30 /*----- Revision history --------------------------------------------------*
  31  *
  32  * $Log: rsa-gen.c,v $
  33  * Revision 1.4  2000/10/08 12:11:22  mdw
  34  * Use @MP_EQ@ instead of @MP_CMP@.
  35  *
  36  * Revision 1.3  2000/07/01 11:22:22  mdw
  37  * Remove bad type name `rsa_param'.
  38  *
  39  * Revision 1.2  2000/06/17 12:05:15  mdw
  40  * Lots of changes:
  41  *
  42  *   * Apply limits on %$\gcd(p - 1, q - 1)$% to reduce the space of
  43  *     equivalent decryption exponents.
  44  *
  45  *   * Force %$e = F_4 = 2^{16} + 1$% to avoid small-encryption-exponent
  46  *     attacks.
  47  *
  48  *   * Ensure that %$p > q$% and that %$p - q$% is large to deter
  49  *     square-root-based factoring methods.
  50  *
  51  *   * Use %$e d \equiv 1 \pmod{\lambda(n)}$%, where %$\lambda(n)$% is
  52  *     %$\lcm(p - 1, q - 1)$%, as recommended in PKCS#1, rather than the
  53  *     more usual %$\varphi(n) = (p - 1)(q - 1)$%.
  54  *
  55  *   * Handle aborts from pgen_jump.
  56  *
  57  * Revision 1.1  1999/12/22 15:50:45  mdw
  58  * Initial RSA support.
  59  *
  60  */
  61
  62 /*----- Header files ------------------------------------------------------*/
  63
  64 #include <mLib/dstr.h>
  65
  66 #include "grand.h"
  67 #include "mp.h"
  68 #include "mpint.h"
  69 #include "pgen.h"
  70 #include "rsa.h"
  71 #include "strongprime.h"
  72
  73 /*----- Main code ---------------------------------------------------------*/
  74
  75 /* --- @rsa_gen@ --- *
  76  *
  77  * Arguments:   @rsa_priv *rp@ = pointer to block to be filled in
  78  *              @unsigned nbits@ = required modulus size in bits
  79  *              @grand *r@ = random number source
  80  *              @unsigned n@ = number of attempts to make
  81  *              @pgen_proc *event@ = event handler function
  82  *              @void *ectx@ = argument for the event handler
  83  *
  84  * Returns:     Zero if all went well, nonzero otherwise.
  85  *
  86  * Use:         Constructs a pair of strong RSA primes and other useful RSA
  87  *              parameters.  A small encryption exponent is chosen if
  88  *              possible.
  89  */
  90
  91 int rsa_gen(rsa_priv *rp, unsigned nbits, grand *r, unsigned n,
  92             pgen_proc *event, void *ectx)
  93 {
  94   pgen_gcdstepctx g;
  95   mp *phi = MP_NEW;
  96
  97   /* --- Bits of initialization --- */
  98
  99   rp->e = mp_fromulong(MP_NEW, 0x10001);
 100   rp->d = MP_NEW;
 101
 102   /* --- Generate strong primes %$p$% and %$q$% --- *
 103    *
 104    * Constrain the GCD of @q@ to ensure that overly small private exponents
 105    * are impossible.  Current results suggest that if %$d < n^{0.29}$% then
 106    * it can be guessed fairly easily.  This implementation is rather more
 107    * conservative about that sort of thing.
 108    */
 109
 110 again:
 111   if ((rp->p = strongprime("p", MP_NEWSEC, nbits/2, r, n, event, ectx)) == 0)
 112     goto fail_p;
 113
 114   /* --- Do painful fiddling with GCD steppers --- */
 115
 116   {
 117     mp *q;
 118     rabin rb;
 119
 120     if ((q = strongprime_setup("q", MP_NEWSEC, &g.jp, nbits / 2,
 121                                r, n, event, ectx)) == 0)
 122       goto fail_q;
 123     g.r = mp_lsr(MP_NEW, rp->p, 1);
 124     g.g = MP_NEW;
 125     g.max = MP_256;
 126     q = pgen("q", q, q, event, ectx, n, pgen_gcdstep, &g,
 127                  rabin_iters(nbits/2), pgen_test, &rb);
 128     pfilt_destroy(&g.jp);
 129     mp_drop(g.r);
 130     if (!q) {
 131       mp_drop(g.g);
 132       if (n)
 133         goto fail_q;
 134       mp_drop(rp->p);
 135       goto again;
 136     }
 137     rp->q = q;
 138   }
 139
 140   /* --- Ensure that %$p > q$% --- *
 141    *
 142    * Also ensure that %$p$% and %$q$% are sufficiently different to deter
 143    * square-root-based factoring methods.
 144    */
 145
 146   phi = mp_sub(phi, rp->p, rp->q);
 147   if (MP_LEN(phi) * 4 < MP_LEN(rp->p) * 3 ||
 148       MP_LEN(phi) * 4 < MP_LEN(rp->q) * 3) {
 149     mp_drop(rp->p);
 150     mp_drop(g.g);
 151     if (n)
 152       goto fail_q;
 153     mp_drop(rp->q);
 154     goto again;
 155   }
 156
 157   if (phi->f & MP_NEG) {
 158     mp *z = rp->p;
 159     rp->p = rp->q;
 160     rp->q = z;
 161   }
 162
 163   /* --- Work out the modulus and the CRT coefficient --- */
 164
 165   rp->n = mp_mul(MP_NEW, rp->p, rp->q);
 166   rp->q_inv = MP_NEW; mp_gcd(0, 0, &rp->q_inv, rp->p, rp->q);
 167
 168   /* --- Work out %$\varphi(n) = (p - 1)(q - 1)$% --- *
 169    *
 170    * Save on further multiplications by noting that %$n = pq$% is known and
 171    * that %$(p - 1)(q - 1) = pq - p - q + 1$%.  To minimize the size of @d@
 172    * (useful for performance reasons, although not very because an overly
 173    * small @d@ will be rejected for security reasons) this is then divided by
 174    * %$\gcd(p - 1, q - 1)$%.
 175    */
 176
 177   phi = mp_sub(phi, rp->n, rp->p);
 178   phi = mp_sub(phi, phi, rp->q);
 179   phi = mp_add(phi, phi, MP_ONE);
 180   phi = mp_lsr(phi, phi, 1);
 181   mp_div(&phi, 0, phi, g.g);
 182
 183   /* --- Decide on a public exponent --- *
 184    *
 185    * Simultaneously compute the private exponent.
 186    */
 187
 188   mp_gcd(&g.g, 0, &rp->d, phi, rp->e);
 189   if (!MP_EQ(g.g, MP_ONE) && MP_LEN(rp->d) * 4 > MP_LEN(rp->n) * 3)
 190     goto fail_e;
 191
 192   /* --- Work out exponent residues --- */
 193
 194   rp->dp = MP_NEW; phi = mp_sub(phi, rp->p, MP_ONE);
 195   mp_div(0, &rp->dp, rp->d, phi);
 196
 197   rp->dq = MP_NEW; phi = mp_sub(phi, rp->q, MP_ONE);
 198   mp_div(0, &rp->dq, rp->d, phi);
 199
 200   /* --- Done --- */
 201
 202   mp_drop(phi);
 203   mp_drop(g.g);
 204   return (0);
 205
 206   /* --- Tidy up when something goes wrong --- */
 207
 208 fail_e:
 209   mp_drop(g.g);
 210   mp_drop(phi);
 211   mp_drop(rp->n);
 212   mp_drop(rp->q_inv);
 213   mp_drop(rp->q);
 214 fail_q:
 215   mp_drop(rp->p);
 216 fail_p:
 217   mp_drop(rp->e);
 218   if (rp->d)
 219     mp_drop(rp->d);
 220   return (-1);
 221 }
 222
 223 /*----- That's all, folks -------------------------------------------------*/