| 1 | /* |
| 2 | * RSA key generation. |
| 3 | */ |
| 4 | |
| 5 | #include "ssh.h" |
| 6 | |
| 7 | #define RSA_EXPONENT 37 /* we like this prime */ |
| 8 | |
| 9 | #if 0 /* bignum diagnostic function */ |
| 10 | static void diagbn(char *prefix, Bignum md) |
| 11 | { |
| 12 | int i, nibbles, morenibbles; |
| 13 | static const char hex[] = "0123456789ABCDEF"; |
| 14 | |
| 15 | printf("%s0x", prefix ? prefix : ""); |
| 16 | |
| 17 | nibbles = (3 + bignum_bitcount(md)) / 4; |
| 18 | if (nibbles < 1) |
| 19 | nibbles = 1; |
| 20 | morenibbles = 4 * md[0] - nibbles; |
| 21 | for (i = 0; i < morenibbles; i++) |
| 22 | putchar('-'); |
| 23 | for (i = nibbles; i--;) |
| 24 | putchar(hex[(bignum_byte(md, i / 2) >> (4 * (i % 2))) & 0xF]); |
| 25 | |
| 26 | if (prefix) |
| 27 | putchar('\n'); |
| 28 | } |
| 29 | #endif |
| 30 | |
| 31 | int rsa_generate(struct RSAKey *key, int bits, progfn_t pfn, |
| 32 | void *pfnparam) |
| 33 | { |
| 34 | Bignum pm1, qm1, phi_n; |
| 35 | |
| 36 | /* |
| 37 | * Set up the phase limits for the progress report. We do this |
| 38 | * by passing minus the phase number. |
| 39 | * |
| 40 | * For prime generation: our initial filter finds things |
| 41 | * coprime to everything below 2^16. Computing the product of |
| 42 | * (p-1)/p for all prime p below 2^16 gives about 20.33; so |
| 43 | * among B-bit integers, one in every 20.33 will get through |
| 44 | * the initial filter to be a candidate prime. |
| 45 | * |
| 46 | * Meanwhile, we are searching for primes in the region of 2^B; |
| 47 | * since pi(x) ~ x/log(x), when x is in the region of 2^B, the |
| 48 | * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about |
| 49 | * 1/0.6931B. So the chance of any given candidate being prime |
| 50 | * is 20.33/0.6931B, which is roughly 29.34 divided by B. |
| 51 | * |
| 52 | * So now we have this probability P, we're looking at an |
| 53 | * exponential distribution with parameter P: we will manage in |
| 54 | * one attempt with probability P, in two with probability |
| 55 | * P(1-P), in three with probability P(1-P)^2, etc. The |
| 56 | * probability that we have still not managed to find a prime |
| 57 | * after N attempts is (1-P)^N. |
| 58 | * |
| 59 | * We therefore inform the progress indicator of the number B |
| 60 | * (29.34/B), so that it knows how much to increment by each |
| 61 | * time. We do this in 16-bit fixed point, so 29.34 becomes |
| 62 | * 0x1D.57C4. |
| 63 | */ |
| 64 | pfn(pfnparam, -1, -0x1D57C4 / (bits / 2)); |
| 65 | pfn(pfnparam, -2, -0x1D57C4 / (bits - bits / 2)); |
| 66 | pfn(pfnparam, -3, 5); |
| 67 | |
| 68 | /* |
| 69 | * We don't generate e; we just use a standard one always. |
| 70 | */ |
| 71 | key->exponent = bignum_from_short(RSA_EXPONENT); |
| 72 | |
| 73 | /* |
| 74 | * Generate p and q: primes with combined length `bits', not |
| 75 | * congruent to 1 modulo e. (Strictly speaking, we wanted (p-1) |
| 76 | * and e to be coprime, and (q-1) and e to be coprime, but in |
| 77 | * general that's slightly more fiddly to arrange. By choosing |
| 78 | * a prime e, we can simplify the criterion.) |
| 79 | */ |
| 80 | key->p = primegen(bits / 2, RSA_EXPONENT, 1, 1, pfn, pfnparam); |
| 81 | key->q = primegen(bits - bits / 2, RSA_EXPONENT, 1, 2, pfn, pfnparam); |
| 82 | |
| 83 | /* |
| 84 | * Ensure p > q, by swapping them if not. |
| 85 | */ |
| 86 | if (bignum_cmp(key->p, key->q) < 0) { |
| 87 | Bignum t = key->p; |
| 88 | key->p = key->q; |
| 89 | key->q = t; |
| 90 | } |
| 91 | |
| 92 | /* |
| 93 | * Now we have p, q and e. All we need to do now is work out |
| 94 | * the other helpful quantities: n=pq, d=e^-1 mod (p-1)(q-1), |
| 95 | * and (q^-1 mod p). |
| 96 | */ |
| 97 | pfn(pfnparam, 3, 1); |
| 98 | key->modulus = bigmul(key->p, key->q); |
| 99 | pfn(pfnparam, 3, 2); |
| 100 | pm1 = copybn(key->p); |
| 101 | decbn(pm1); |
| 102 | qm1 = copybn(key->q); |
| 103 | decbn(qm1); |
| 104 | phi_n = bigmul(pm1, qm1); |
| 105 | pfn(pfnparam, 3, 3); |
| 106 | freebn(pm1); |
| 107 | freebn(qm1); |
| 108 | key->private_exponent = modinv(key->exponent, phi_n); |
| 109 | pfn(pfnparam, 3, 4); |
| 110 | key->iqmp = modinv(key->q, key->p); |
| 111 | pfn(pfnparam, 3, 5); |
| 112 | |
| 113 | /* |
| 114 | * Clean up temporary numbers. |
| 115 | */ |
| 116 | freebn(phi_n); |
| 117 | |
| 118 | return 1; |
| 119 | } |