Initial RSA support.

[u/mdw/catacomb] / rsa-decrypt.c

diff --git a/rsa-decrypt.c b/rsa-decrypt.c
new file mode 100644 (file)
index 0000000..808987c
--- /dev/null
+++ b/rsa-decrypt.c
@@ -0,0 +1,142 @@
+/* -*-c-*-
+ *
+ * $Id: rsa-decrypt.c,v 1.1 1999/12/22 15:50:45 mdw Exp $
+ *
+ * RSA decryption
+ *
+ * (c) 1999 Straylight/Edgeware
+ */
+
+/*----- Licensing notice --------------------------------------------------* 
+ *
+ * This file is part of Catacomb.
+ *
+ * Catacomb is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ * 
+ * Catacomb is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Library General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Library General Public
+ * License along with Catacomb; if not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+/*----- Revision history --------------------------------------------------* 
+ *
+ * $Log: rsa-decrypt.c,v $
+ * Revision 1.1  1999/12/22 15:50:45  mdw
+ * Initial RSA support.
+ *
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include "mp.h"
+#include "mpmont.h"
+#include "mprand.h"
+#include "rsa.h"
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @rsa_decrypt@ --- *
+ *
+ * Arguments:  @rsa_param *rp@ = pointer to RSA parameters
+ *             @mp *d@ = destination
+ *             @mp *c@ = ciphertext message
+ *             @grand *r@ = pointer to random number source for blinding
+ *
+ * Returns:    Correctly decrypted message.
+ *
+ * Use:                Performs RSA decryption, very carefully.
+ */
+
+mp *rsa_decrypt(rsa_param *rp, mp *d, mp *c, grand *r)
+{
+  mp *ki = MP_NEW;
+
+  /* --- If so desired, set up a blinding constant --- *
+   *
+   * Choose a constant %$k$% relatively prime to the modulus %$m$%.  Compute
+   * %$c' = c k^e \bmod n$%, and %$k^{-1} \bmod n$%.
+   */
+
+  c = MP_COPY(c);
+  if (r) {
+    mp *k = MP_NEW, *g = MP_NEW;
+    mpmont mm;
+
+    do {
+      k = mprand_range(k, rp->n, r, 0);
+      mp_gcd(&g, 0, &ki, rp->n, k);
+    } while (MP_CMP(g, !=, MP_ONE));
+    mpmont_create(&mm, rp->n);
+    k = mpmont_expr(&mm, k, k, rp->e);
+    c = mpmont_mul(&mm, c, c, k);
+    mp_drop(k);
+    mp_drop(g);
+  }
+
+  /* --- Do the actual modular exponentiation --- *
+   *
+   * Use a slightly hacked version of the Chinese Remainder Theorem stuff.
+   *
+   * Let %$q' = q^{-1} \bmod p$%.  Then note that
+   * %$c^d \equiv q (q'(c_p^{d_p} - c_q^{d_q}) \bmod p) + c_q^{d_q} \pmod n$%
+   */
+
+  {
+    mpmont mm;
+    mp *cp = MP_NEW, *cq = MP_NEW;
+
+    /* --- Work out the two halves of the result --- */
+
+    mp_div(0, &cp, c, rp->p);
+    mpmont_create(&mm, rp->p);
+    cp = mpmont_exp(&mm, cp, cp, rp->dp);
+    mpmont_destroy(&mm);
+
+    mp_div(0, &cq, c, rp->q);
+    mpmont_create(&mm, rp->q);
+    cq = mpmont_exp(&mm, cq, cq, rp->dq);
+    mpmont_destroy(&mm);
+
+    /* --- Combine the halves using the result above --- */
+
+    d = mp_sub(d, cp, cq);
+    if (cp->f & MP_NEG)
+      d = mp_add(d, d, rp->p);
+    d = mp_mul(d, d, rp->q_inv);
+    mp_div(0, &d, d, rp->p);
+
+    d = mp_mul(d, d, rp->q);
+    d = mp_add(d, d, cq);
+    if (MP_CMP(d, >=, rp->n))
+      d = mp_sub(d, d, rp->n);
+
+    /* --- Tidy away temporary variables --- */
+
+    mp_drop(cp);
+    mp_drop(cq);
+  }
+
+  /* --- Finally, possibly remove the blinding factor --- */
+
+  if (ki) {
+    d = mp_mul(d, d, ki);
+    mp_div(0, &d, d, rp->n);
+    mp_drop(ki);
+  }
+
+  /* --- Done --- */
+
+  mp_drop(c);
+  return (d);
+}
+
+/*----- That's all, folks -------------------------------------------------*/