Fix a bug in argument validation. Force %$p > q$% in output. Use

%$\lambda(n) = \lcm(p - 1, q - 1)$% rather than the more traditional
%$\phi(n) = (p - 1)(q - 1)$% when computing the decryption exponent.

diff --git a/rsa-recover.c b/rsa-recover.c
index c125aef..14b67bd 100644 (file)
--- a/rsa-recover.c
+++ b/rsa-recover.c
@@ -1,6 +1,6 @@
 /* -*-c-*-
  *
- * $Id: rsa-recover.c,v 1.1 1999/12/22 15:50:45 mdw Exp $
+ * $Id: rsa-recover.c,v 1.2 2000/06/17 12:07:19 mdw Exp $
  *
  * Recover RSA parameters
  *
@@ -30,6 +30,11 @@
 /*----- Revision history --------------------------------------------------* 
  *
  * $Log: rsa-recover.c,v $
+ * Revision 1.2  2000/06/17 12:07:19  mdw
+ * Fix a bug in argument validation.  Force %$p > q$% in output.  Use
+ * %$\lambda(n) = \lcm(p - 1, q - 1)$% rather than the more traditional
+ * %$\phi(n) = (p - 1)(q - 1)$% when computing the decryption exponent.
+ *
  * Revision 1.1  1999/12/22 15:50:45  mdw
  * Initial RSA support.
  *
@@ -84,7 +89,9 @@ int rsa_recover(rsa_param *rp)
 
     /* --- Otherwise use the public and private moduli --- */
 
-    else if (rp->e && rp->d) {
+    else if (!rp->e || !rp->d)
+      return (-1);
+    else {
       mp *t;
       unsigned s;
       mpscan ms;
@@ -182,6 +189,11 @@ int rsa_recover(rsa_param *rp)
       mp_drop(z);
       mp_drop(t);
       mp_drop(m1);
+      if (MP_CMP(rp->p, <, rp->q)) {
+       z = rp->p;
+       rp->p = rp->q;
+       rp->q = z;
+      }
       mpmont_destroy(&mm);
     }
   }
@@ -191,12 +203,19 @@ int rsa_recover(rsa_param *rp)
   if (!rp->e || !rp->d) {
     mp *phi;
     mp *g = MP_NEW;
+    mp *p1, *q1;
 
     /* --- Compute %$\varphi(n)$% --- */
 
     phi = mp_sub(MP_NEW, rp->n, rp->p);
     phi = mp_sub(phi, phi, rp->q);
     phi = mp_add(phi, phi, MP_ONE);
+    p1 = mp_sub(MP_NEW, rp->p, MP_ONE);
+    q1 = mp_sub(MP_NEW, rp->q, MP_ONE);
+    mp_gcd(&g, 0, 0, p1, q1);
+    mp_div(&phi, 0, phi, g);
+    mp_drop(p1);
+    mp_drop(q1);
 
     /* --- Recover the other exponent --- */
 
@@ -206,6 +225,7 @@ int rsa_recover(rsa_param *rp)
       mp_gcd(&g, 0, &rp->e, phi, rp->d);
     else {
       mp_drop(phi);
+      mp_drop(g);
       return (-1);
     }