7 #define RSA_EXPONENT 37 /* we like this prime */
9 int rsa_generate(struct RSAKey
*key
, int bits
, progfn_t pfn
,
12 Bignum pm1
, qm1
, phi_n
;
13 unsigned pfirst
, qfirst
;
16 * Set up the phase limits for the progress report. We do this
17 * by passing minus the phase number.
19 * For prime generation: our initial filter finds things
20 * coprime to everything below 2^16. Computing the product of
21 * (p-1)/p for all prime p below 2^16 gives about 20.33; so
22 * among B-bit integers, one in every 20.33 will get through
23 * the initial filter to be a candidate prime.
25 * Meanwhile, we are searching for primes in the region of 2^B;
26 * since pi(x) ~ x/log(x), when x is in the region of 2^B, the
27 * prime density will be d/dx pi(x) ~ 1/log(B), i.e. about
28 * 1/0.6931B. So the chance of any given candidate being prime
29 * is 20.33/0.6931B, which is roughly 29.34 divided by B.
31 * So now we have this probability P, we're looking at an
32 * exponential distribution with parameter P: we will manage in
33 * one attempt with probability P, in two with probability
34 * P(1-P), in three with probability P(1-P)^2, etc. The
35 * probability that we have still not managed to find a prime
36 * after N attempts is (1-P)^N.
38 * We therefore inform the progress indicator of the number B
39 * (29.34/B), so that it knows how much to increment by each
40 * time. We do this in 16-bit fixed point, so 29.34 becomes
43 pfn(pfnparam
, PROGFN_PHASE_EXTENT
, 1, 0x10000);
44 pfn(pfnparam
, PROGFN_EXP_PHASE
, 1, -0x1D57C4 / (bits
/ 2));
45 pfn(pfnparam
, PROGFN_PHASE_EXTENT
, 2, 0x10000);
46 pfn(pfnparam
, PROGFN_EXP_PHASE
, 2, -0x1D57C4 / (bits
- bits
/ 2));
47 pfn(pfnparam
, PROGFN_PHASE_EXTENT
, 3, 0x4000);
48 pfn(pfnparam
, PROGFN_LIN_PHASE
, 3, 5);
49 pfn(pfnparam
, PROGFN_READY
, 0, 0);
52 * We don't generate e; we just use a standard one always.
54 key
->exponent
= bignum_from_long(RSA_EXPONENT
);
57 * Generate p and q: primes with combined length `bits', not
58 * congruent to 1 modulo e. (Strictly speaking, we wanted (p-1)
59 * and e to be coprime, and (q-1) and e to be coprime, but in
60 * general that's slightly more fiddly to arrange. By choosing
61 * a prime e, we can simplify the criterion.)
63 invent_firstbits(&pfirst
, &qfirst
);
64 key
->p
= primegen(bits
/ 2, RSA_EXPONENT
, 1, NULL
,
65 1, pfn
, pfnparam
, pfirst
);
66 key
->q
= primegen(bits
- bits
/ 2, RSA_EXPONENT
, 1, NULL
,
67 2, pfn
, pfnparam
, qfirst
);
70 * Ensure p > q, by swapping them if not.
72 if (bignum_cmp(key
->p
, key
->q
) < 0) {
79 * Now we have p, q and e. All we need to do now is work out
80 * the other helpful quantities: n=pq, d=e^-1 mod (p-1)(q-1),
83 pfn(pfnparam
, PROGFN_PROGRESS
, 3, 1);
84 key
->modulus
= bigmul(key
->p
, key
->q
);
85 pfn(pfnparam
, PROGFN_PROGRESS
, 3, 2);
90 phi_n
= bigmul(pm1
, qm1
);
91 pfn(pfnparam
, PROGFN_PROGRESS
, 3, 3);
94 key
->private_exponent
= modinv(key
->exponent
, phi_n
);
95 pfn(pfnparam
, PROGFN_PROGRESS
, 3, 4);
96 key
->iqmp
= modinv(key
->q
, key
->p
);
97 pfn(pfnparam
, PROGFN_PROGRESS
, 3, 5);
100 * Clean up temporary numbers.